Privacy Policy - Poolside Apartment Siófok

PRIVACY POLICY
Poolside Apartment – SIÓFOK
Data Controller: Éva Ballagó
Date: 1 June 2022

TABLE OF CONTENTS

Introduction
The Data Controller and Contact Details
Data Protection Officer
Rules of Data Processing
Principles Relating to the Processing of Personal Data
Legal Basis for Data Processing
Data Processing Activities
7.1. Accommodation Booking
7.2. Contact, Communication, Request for Quotation
7.3. Privacy Policy of Booking Platforms
7.4. Guest Registration
7.5. “Vendégem” (My Guest) Simplified Guest Registry Application (Accommodation Management Software)
7.6. Possible Consequences of Failure to Provide Data
Recipients of Personal Data / Data Processors
Data Security Measures
Rights of Data Subjects
Legal Remedies
Rules Regarding Requests Sent by the Data Subject to the Data Controller
Procedure in Case of a Data Protection Incident
Acceptance and Modification of the Privacy Policy
Main Laws and Abbreviations Applicable to Data Processing

1. INTRODUCTION
1.1. Éva Ballagó, a private individual with a tax number (hereinafter referred to as: Data Controller), hereby fulfills her obligation to provide information in accordance with the General Data Protection Regulation of the European Union (Regulation (EU) 2016/679 of the European Parliament and of the Council) (hereinafter: GDPR) regarding the processing of personal data in connection with her accommodation service activity.
1.2. The Data Controller ensures the lawfulness and purpose limitation of data processing in all cases concerning the personal data managed.
1.3. The purpose of this Privacy Policy is to provide the Data Subjects (i.e., those interested in the accommodation service and guests) with clear, detailed, easily understandable and accessible information about all facts related to the processing of their personal data, as well as their rights and legal remedies, before the start of data processing.
1.4. The Data Controller uses the personal data under her control exclusively for the purpose for which it was provided by the data subject (e.g., communication). Data will not be transferred to third parties, except where required by law (e.g., invoicing). Only those data are stored which are required by legal obligations or authorized by the Data Subject, and the data is protected against unauthorized use.
1.5. The Data Controller makes this Privacy Policy continuously available at the accommodation operated by her – at 8600 Siófok, Bláthy Ottó St. 31. A/2 – and sends it to the Data Subjects in the first email during the contact process.
1.6. Submitting a booking request by the Data Subject shall be deemed acceptance of this Privacy Policy, acknowledging its contents and constituting voluntary consent to the processing of personal data.

2. DATA CONTROLLER AND CONTACT DETAILS
• Name: Éva Ballagó, private individual with tax number
• Tax Number: 57274636-1-33
• Registered Office: 2131 Göd, Erzsébet liget St. 98–108. C/9
• Mailing Address: 2131 Göd, Erzsébet liget St. 98–108. C/9
• Phone: +36 30 447 9736
• Email: blathyotto31@gmail.com

2.1. Accommodation operated by the Data Controller:
• Name: Poolside Apartment
• Type: Private Accommodation
• Address: 8600 Siófok, Bláthy Ottó St. 31. A/2
• Registration Number: 4808/2022
• NTAK Registration Number: MA22032690

2.2. Contact details of Poolside Apartment:
• Phone: +36 30 447 9736
• Email: blathyotto31@gmail.com

3. DATA PROTECTION OFFICER
The Data Controller does not carry out any activities that would require the appointment of a Data Protection Officer.

4. RULES OF DATA PROCESSING
The terminology used in this Privacy Policy corresponds to the definitions set out in Article 4 of the GDPR.

4.1. Personal Data: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

4.2. Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

4.3. Filing System: any structured set of personal data which are accessible according to specific criteria, whether centralized, decentralized or dispersed on a functional or geographical basis.

4.4. Data Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

4.5. Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

4.6. Recipient: a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.

4.7. Third Party: a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

4.8. Consent of the Data Subject: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

4.9. Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

5. PRINCIPLES RELATING TO THE PROCESSING OF PERSONAL DATA
Personal data must be:
5.1. processed lawfully, fairly, and in a transparent manner in relation to the Data Subject (“lawfulness, fairness and transparency”);
5.2. collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes (“purpose limitation”);
5.3. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimization”);
5.4. accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (“accuracy”);
5.5. kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (“storage limitation”);
5.6. processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures (“integrity and confidentiality”);
5.7. The controller shall be responsible for, and be able to demonstrate compliance with, the above (“accountability”).

6. LEGAL BASIS FOR DATA PROCESSING
6.1. The Data Controller shall process personal data only if one of the following legal bases applies:
6.1.1. The Data Subject has given voluntary, specific, informed, unambiguous, and verifiable consent to the processing of their personal data for a specific purpose;
6.1.2. Processing is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract;
6.1.3. Processing is necessary for compliance with a legal obligation to which the Data Controller is subject;
6.1.4. Processing is necessary in order to protect the vital interests of the Data Subject or another natural person;
6.1.5. Processing is necessary for the performance of a task carried out in the public interest;
6.1.6. Processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, provided that such interests can be justified through a balancing test.

7. DATA PROCESSING OPERATIONS
The accommodation service operated by the Data Controller, Poolside Apartman, is a private accommodation registered under number 4570/2021 by the Municipality of Siófok in accordance with Government Decree 239/2009 (X.20.) on the detailed conditions for carrying out accommodation service activities and the issuance of operating licenses.

7.1. Contact, communication, requesting offers
7.1.1. Scope of Data Subjects: individuals interested in using the accommodation service, former guests of the accommodation service.
7.1.2. Categories of personal data processed: Data Subjects may choose how they contact us—by phone, email, or via our Facebook page.
When requesting an offer, the Data Controller requests the following information from the Data Subject: name and contact details (email address, phone number).
7.1.3. Purpose of data processing: to establish contact, maintain communication, provide information, and send price quotes.
The Data Controller may occasionally send holiday offers by email exclusively to former guests.
7.1.4. Legal basis for processing: voluntary contact initiated by the Data Subject, with the Data Subject’s voluntary consent.
/GDPR Article 6(1)(a)/
7.1.5. Persons authorized to access the data: the Data Controller and the Data Controller’s spouse.
7.1.6. Duration of data processing: The Data Controller deletes the data of those interested in the accommodation service within 14 days of sending the quote.
The Data Controller retains the contact data of former guests for 3 years or until a deletion request is submitted by the Data Subject.

7.2. Accommodation booking
7.2.1. Scope of Data Subjects: individuals who submit a booking request for the accommodation service.
7.2.2. Categories of personal data processed: Bookings may be submitted via phone, email, or through an accommodation intermediary portal.
For direct bookings received by the Data Controller, the following information is requested from the Data Subjects: name, address, and contact details (email address, phone number).
7.2.3. Purpose of data processing: provision of accommodation service.
7.2.4. Legal basis for processing: performance of a contract and compliance with a legal obligation (invoicing).
/GDPR Article 6(1)(b) and (c)/
7.2.5. Persons authorized to access the data: the Data Controller, the Data Controller’s spouse, Bán Anita (authorized to hand over the apartment), and the following data processors: the Data Controller’s invoicing service provider (szamlazz.hu), the Data Controller’s accountant, and the National Tax and Customs Administration (NAV).
7.2.6. Duration of data processing: The Data Controller stores the personal data of those who book and use the accommodation service for 8 years after the termination of the contract.

7.3. Privacy policies of accommodation booking websites:
For bookings made through szallas.hu, guests can find information on the processing of their personal data at the following link: https://szallas.hu/adatvedelem
For bookings made through booking.com, guests can find information at: https://www.booking.com/content/privacy.hu.html
For bookings made through airbnb.hu, guests can find information at: https://www.airbnb.hu/help/article/3175/adatv%C3%A9delmi-szab%C3%A1lyzat

The accommodation operated by the Data Controller is also available on the Facebook social media platform under the name “Poolside Apartman Siófok,” at the following link: https://www.facebook.com/poolsideapartmansiofok
Information about Facebook’s data processing is available at: https://www.facebook.com/about/privacy/update

7.4. Guest registry (Vendégem.hu)
7.4.1. Scope of Data Subjects: guests who used the accommodation service.
7.4.2. Categories of personal data processed: – surname and first name; – place and date of birth; – nationality; – address; – ID document number, for foreign guests: passport, visa, or residence permit number, scanned image; – arrival and departure dates, number of guest nights; – reason for exemption from tourism tax; – email address; – guest’s signature.
7.4.3. Purpose of data processing: compliance with registration obligations and submission of tourism tax declarations.
7.4.4. Legal basis for processing: compliance with legal obligations applicable to the Data Controller. Based on Act C of 1990 on Local Taxes, Section 30, and the municipal regulation 45/2007 (XII.14.) of the Municipal Assembly of the Municipality of Siófok on local taxes and tax procedures.
/GDPR Article 6(1)(c)/
7.4.5. Persons authorized to access the data: the Data Controller, Bán Anita (authorized to hand over the apartment), as well as the Clerk of the Municipality of Siófok and persons authorized to inspect data for tourism tax audit, including Vendégem.hu.
7.4.6. Duration of data processing: the guest registry must be retained for the statute of limitation period specified in Section 202(1) of Act CL of 2017 on the Rules of Taxation.

7.5. Vendégem simplified guest registry application (accommodation management software)
7.5.1. Under the supervision of the Hungarian Tourism Agency, a national statistical data collection IT system called the National Tourism Data Supply Centre (hereinafter: NTAK) is operated.
Only statistical data is transmitted to NTAK via the Vendégem accommodation management software; no personal data is accepted, recorded, or stored. Based on the incoming data, guests cannot be identified, meaning no personal data is transmitted to NTAK.
Nonetheless, the Data Subject is informed of the data processing rules as follows:
7.5.2. Scope of Data Subjects: guests who used the accommodation service.
7.5.3. Categories of data processed: – gender, nationality; – place and date of birth; – country of residence; – municipality and postal code of permanent residence.

7.5.4. Purpose of the data processing:
To ensure the real-time and up-to-date measurement of traffic statistics for all domestic accommodations, and based on the incoming statistical data, to prepare reports, summaries, and analyses for the tourism sector.

7.5.5. Legal basis for the data processing:
The fulfillment of legal obligations applicable to the Data Controller.
Based on Act CLVI of 2016 on the state responsibilities related to the development of tourism regions, as well as Government Decree 235/2019 (X.15.) on its implementation, and Government Decree 239/2009 (X.20.) on the detailed conditions for carrying out accommodation service activities and the issuance of operating licenses.

According to Section 5(3) of Government Decree 239/2009 (X.20.), accommodation services may only be provided at accommodations that are equipped with accommodation management software. The software transmits the accommodation service data to NTAK electronically, in a manner prescribed by law, thereby ensuring the Data Controller’s compliance with the legislation.
The obligation to provide data may only be fulfilled electronically via software.
This data reporting obligation has been in effect since January 1, 2020.

7.5.6. Persons authorized to access the data:

The Data Controller and the Data Controller’s spouse
Hungarian Tourism Agency: prepares reports, summaries, and analyses for the tourism sector based on the incoming statistical data
Municipality of Siófok: for the purpose of monitoring the payment of tourism tax, it has access to the relevant statistical data of accommodations within its jurisdiction
National Tax and Customs Administration (NAV): has access to the revenue data related to accommodation services to improve the effectiveness of its supervisory procedures
Hungarian Central Statistical Office: has access to the data specified by law to carry out its tasks defined in the statistical legislation

7.6. Possible consequences of failure to provide data:
The impossibility of using the services described in Sections 7.2 and 7.3 above.

8. RECIPIENTS OF PERSONAL DATA / DESIGNATED DATA PROCESSORS
A data processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller (GDPR Article 4, point 8).
Prior consent of the data subject is not required for the use of a data processor, but the data subject must be informed. Accordingly, we provide the following information:

8.1. Data Controller’s invoicing service provider
8.1.1. To fulfill its invoicing obligations, the Data Controller engages an external service provider by contract, who also processes the personal data of natural persons having a contractual or payee relationship with the Data Controller, for the purpose of fulfilling the Data Controller’s invoicing obligations.
8.1.2. The name of this data processor is as follows:

Name: National Tax and Customs Administration (NAV)
Registered Office: 1054 Budapest, Széchenyi u. 2.
Phone: +36 (1) 428 5100
Contact: https://nav.gov.hu/ugyfeliranytu/keressen_minket/levelkuldes
Website: https://onlineszamla.nav.gov.hu/
Privacy Notice: https://onlineszamla.nav.gov.hu/tajekoztatas_a_szamlaadatszolgaltatas

8.1.3. Purpose of the data processing: fulfillment of invoicing obligations.

8.2. Data Controller’s accountant
8.2.1. The invoice data issued by the Data Controller to its guests is forwarded to the accountant for the fulfillment of obligations based on legislation.
8.2.2. Purpose of the data processing: bookkeeping, tax return.

8.3. National Tax and Customs Administration (NAV)
8.3.1. As of January 1, 2021, the content of all invoices issued by the Data Controller is forwarded to NAV.
8.3.2. Purpose of the data processing: fulfillment of invoice data reporting obligations.

8.4. Recipients of statistical data recorded in the Vendégem application:

Clerk of the Municipality of Siófok
Hungarian Tourism Agency
National Tax and Customs Administration
Hungarian Central Statistical Office

8.4.1. Purpose of the data processing: provision of statistical data.

9. DATA SECURITY MEASURES
9.1. Personal data is stored both electronically and on paper. The storage location of personal data is the registered office of the Data Controller as indicated in this Privacy Notice.
9.2. In respect of all purposes and legal bases of data processing, the Data Controller takes all reasonable measures to ensure the security of personal data, both in terms of the network system and during data storage and retention.
9.3. The Data Controller protects the data against accidental or unlawful destruction, loss, alteration, damage, unauthorized disclosure, or unauthorized access using appropriate measures.
9.4. The Data Controller protects its IT systems, electronic data processing, and records with firewalls, antivirus protection, and passwords, in compliance with data security requirements.
9.5. Only the Data Controller and the Data Controller’s spouse have access to the data.

10. RIGHTS OF THE DATA SUBJECTS

10.1. Right to prior information
The data subject has the right to receive information about the facts and details related to data processing before the processing begins.

10.2. Right of access
10.2.1. The data subject has the right to request information from the Data Controller about the processing of their personal data.
10.2.2. The data subject has the right to receive feedback from the Data Controller on whether their personal data are being processed, and if such processing is ongoing, they have the right to access the personal data and to be informed about the purpose of data processing, the legal basis, the personal data being processed, the data processor, the duration of the data processing, their rights, and the right to lodge a complaint.
10.2.3. The Data Controller shall provide the data subject with a copy of the personal data subject to processing.

10.3. Right to rectification
The data subject has the right to request the Data Controller to rectify inaccurate personal data concerning them without undue delay. Taking into account the purpose of data processing, the data subject also has the right to request the completion of incomplete personal data.

10.4. Right to erasure
10.4.1. The Data Controller shall erase the personal data concerning the data subject without undue delay upon request if one of the following grounds applies:

the purpose of data processing no longer exists, or
the data subject withdraws their consent to the processing of personal data and there is no other legal basis for the processing, or
the data subject exercises their right to object, or
the data processing is unlawful, or
the deletion of the data is required by law.
10.4.2. The deletion requested by the data subject may only apply to data processed based on their consent and does not affect data processed for the performance of a contract or to comply with a legal obligation.

10.5. Right to restriction of processing
10.5.1. Upon the data subject’s request, the Data Controller shall restrict processing in the following cases:

the data subject disputes the accuracy of the personal data; in this case, the restriction shall apply for the period enabling the Data Controller to verify the accuracy of the personal data; or
the data processing is unlawful, but the data subject does not request the deletion of the data, only the restriction of its use; or
the Data Controller no longer needs the personal data for processing, but the data subject requires them for the establishment, exercise, or defense of legal claims; or
the data subject has objected to data processing; in this case, the restriction applies until it is determined whether the legitimate grounds of the Data Controller override those of the data subject.
10.5.2. The Data Controller shall inform the data subject in advance about the lifting of the restriction upon the data subject’s request.

10.6. Obligation to notify concerning rectification or erasure of personal data or restriction of processing
The Data Controller shall inform all recipients to whom the personal data have been disclosed of any rectification, erasure, or restriction of processing unless this proves impossible or involves disproportionate effort. Upon request, the Data Controller shall inform the data subject about these recipients.

10.7. Right to data portability
Under the conditions set out in the GDPR, the data subject has the right to receive the personal data provided to the Data Controller in a structured, commonly used, and machine-readable format and has the right to transmit those data to another data controller.

10.8. Right to object
The data subject may object to the processing of their personal data if the processing or transmission is necessary solely for enforcing the legitimate interests of the Data Controller or a third party (except in the case of mandatory processing). If the Data Controller finds the objection justified, they shall immediately delete the personal data.

10.9. Right to withdraw consent
The data subject has the right to withdraw their consent to the processing of their personal data at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

11. LEGAL REMEDIES

11.1. Right to lodge a complaint with a supervisory authority (administrative remedy)
The data subject has the right to lodge a complaint with a supervisory authority if they believe that the processing of their personal data violates the GDPR.
In Hungary, the data subject may submit a complaint regarding the Data Controller’s data processing procedure to the National Authority for Data Protection and Freedom of Information (NAIH).

Mailing address: 1363 Budapest, P.O. Box: 9.
Address: 1055 Budapest, Falk Miksa Street 9-11.
Phone: +36 (1) 391-1400
Fax: +36 (1) 391-1410
Email: ugyfelszolgalat@naih.hu
Website: https://naih.hu

11.2. Right to judicial remedy
The data subject may also enforce their claims through the courts, at their choice. The case falls under the jurisdiction of the regional court. The lawsuit may be initiated – at the choice of the data subject – before the regional court of the data subject’s place of residence or habitual residence.

12. RULES REGARDING REQUESTS SENT BY THE DATA SUBJECT TO THE DATA CONTROLLER

12.1. The data subject shall send any requests mentioned in this Notice and the withdrawal of their consent to data processing in writing to the following address:
Mailing address: Municipality of Siófok, 8600 Siófok, Fő tér 1.

12.2. The Data Controller shall examine incoming requests without delay and fulfill the request no later than 30 days after receipt. If the Data Controller considers the request of the data subject unfounded and refuses to fulfill it, the refusal and its reasons, along with information about the available legal remedies, shall be communicated in writing within 30 days of receiving the request.

13. PROCEDURE IN CASE OF A DATA PROTECTION INCIDENT

13.1. The Data Controller protects the personal data of the data subject to the best of its ability, provides a modern and reliable IT environment, and carries out internal processes in a regulated manner to prevent, avoid, or, if it occurs, detect, investigate, and manage any error, problem, or incident concerning personal data processing.

13.2. A data protection incident is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

13.3. If the data subject becomes aware of a data protection incident related to their personal data processed by the Data Controller as defined above, they are requested to notify the contacts indicated in section 12.1 without delay. The Data Controller shall examine the data protection incident without delay and, if the incident is likely to pose a risk to the rights and freedoms of natural persons, report it to the National Authority for Data Protection and Freedom of Information within 72 hours at the latest and take measures to remedy the incident. The Data Controller keeps records of data protection incidents.

14. ACCEPTANCE AND MODIFICATION OF THE DATA PROTECTION NOTICE

14.1. The Data Controller makes this Data Protection Notice continuously available at the accommodation it operates – at 8600 Siófok, Bláthy Ottó St. 31. A/2 – and sends it in the first email during initial contact.

14.2. The submission of a booking intention by the data subject is considered acceptance of this Data Protection Notice, acknowledgment of having read it, and voluntary consent to data processing.

14.3. The Data Controller is entitled to unilaterally modify this Data Protection Notice. The amended Data Protection Notice shall be published at the accommodation it operates.

15. MAIN LAWS APPLICABLE TO DATA PROCESSING AND THEIR ABBREVIATIONS

Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) – on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation, GDPR);
Act CXII of 2011 on the Right to Informational Self-Determination and on the Freedom of Information (Infotv.);
Act V of 2013 on the Civil Code (Ptk.);
Act C of 2000 on Accounting;
Act CL of 2017 on the Rules of Taxation;
Act CLVI of 2016 on the State Tasks for the Development of Tourism Areas;
Government Decree No. 235/2019 (X. 15.) on the implementation of Act CLVI of 2016;
Government Decree No. 239/2009 (X. 20.) on the detailed conditions of accommodation service provision and the issuance procedure of operating permits;
Act C of 1990 on Local Taxes;
Decree No. 45/2007 (XII.14.) of the Representative Body of the Municipality of Siófok on local taxes and the order of taxation.

Dated: Siófok, 1 June 2022
…………………………………………..
Éva Ballagó
Data Controller