A Hajdúszoboszló Tourism Nonprofit Limited Liability Company (company registration number: 09-09-017830, tax number: 14960079-2-09, registered office: 4200 Hajdúszoboszló, József Attila utca 2-18.), (hereinafter referred to as the Service Provider, Data Controller), hereby submits to the following policy:
The following information is provided pursuant to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation (EC) No 95/46/EC (General Data Protection Regulation).
This Privacy Policy governs the processing of data on the following website and its mobile application: https://hajduszoboszlo.hu
The privacy policy is available on the following page: https://hajduszoboszlo.hu/felhasznalas-es-adatvedelem
Amendments to the Rules will enter into force upon publication at the above address.
Name: Hajdúszoboszló Tourism Nonprofit Limited Liability Company
Seat: 4200 Hajdúszoboszló, József Attila utca 2-18.
E-mail: turizmus@hajduszoboszlo.hu
Telephone: +36 52 558 928
1. „personal data”: any information relating to an identified or identifiable natural person („data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
2. „processing”: any operation or set of operations which is performed upon personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
3. „controller”: the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of the processing are determined by Union or Member State law, the controller or the specific criteria for the controller's designation may also be determined by Union or Member State law;
4. „data processor”: a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller;
5. „recipient”: the natural or legal person, public authority, agency or any other body with whom or to which the personal data are disclosed, whether or not a third party. Public authorities which may have access to personal data in the context of an individual investigation in accordance with Union or Member State law are not recipients; the processing of those data by those public authorities should comply with the applicable data protection rules in accordance with the purposes of the processing;
6. „consent of the data subject”: a freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she signifies, by a statement or by an act expressing his or her unambiguous consent, that he or she signifies his or her agreement to the processing of personal data concerning him or her;
7. „Data breaches”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
Personal data:
The controller is responsible for compliance with the above and must be able to demonstrate such compliance („accountability”).
The controller declares that its processing will be carried out in accordance with the principles set out in this point.
1. The fact of data collection, the scope of the data processed and the the purpose of the processing:
The e-mail address does not need to contain any personal data.
2. Who is affected: All data subjects who shop on the webshop website.
3. Duration of data processing, deadline for deletion of data: If one of the conditions set out in Article 17(1) of the GDPR is met, it shall continue until the data subject's request for erasure. The controller shall inform the data subject by electronic means of the erasure of any personal data provided by the data subject pursuant to Article 19 of the GDPR. If the data subject's request for erasure also includes the e-mail address provided by him or her, the controller shall erase the e-mail address following the notification. Except in the case of accounting records, since pursuant to Article 169 (2) of Act C of 2000 on Accounting, these data must be kept for 8 years. The contractual data of the data subject may be deleted after the expiry of the civil law limitation period on the basis of a request for deletion by the data subject.
The accounting documents (including general ledger accounts, analytical or detailed records) directly and indirectly supporting the accounting accounts must be kept for at least 8 years in a legible form, retrievable by reference to the accounting records.
4. The identity of the potential controllers of the data, the recipients of the personal data: Personal data may be processed by the sales and marketing staff of the controller, in compliance with the above principles.
5. Description of data subjects' rights in relation to data processing:
6. The data subject may request access to, deletion, modification or restriction of processing of personal data, or the portability of data in the following ways:
7. Legal basis for processing:
7.1 Article 6(1)(b) and (c) of the GDPR,
7.2 Paragraph (3) of Article 13/A of Act CVIII of 2001 on certain aspects of electronic commerce services and information society services (hereinafter: Elker Act):
The service provider may process personal data that are technically necessary for the provision of the service. The provider must, other conditions being equal, choose and in any case operate the means used in the provision of the information society service in such a way that personal data are processed only to the extent strictly necessary for the provision of the service and for the fulfilment of the other purposes laid down in this Act, but only to the extent and for the duration necessary.
7.3 If the invoice is issued in accordance with accounting legislation, Article 6(1)(c).
7.4 In the event of enforcement of claims arising from the contract, the period of limitation shall be 5 years pursuant to § 6:21 of Act V of 2013 on the Civil Code.
§ 6:22 [Limitation period]
8. Please be informed that
1. The fact of data collection, the scope of the data processed and the the purposes of the processing:
The e-mail address does not need to contain any personal data.
2. Who is affected: all data subjects who request a quote on the website.
3. Duration of data processing, deadline for deletion of data: If one of the conditions set out in Article 17(1) of the GDPR is met, it shall continue until the data subject's request for erasure. The controller shall inform the data subject by electronic means of the erasure of any personal data provided by the data subject pursuant to Article 19 of the GDPR. If the data subject's request for erasure also includes the e-mail address provided by him or her, the controller shall erase the e-mail address following the notification.
4. The identity of the potential controllers of the data, the recipients of the personal data: The personal data may be processed by authorised staff of the controller and will be transmitted to the accommodation of your choice.
5. Description of data subjects' rights in relation to data processing:
6. The data subject may request access to, deletion, modification or restriction of processing of personal data, or the portability of data in the following ways:
7. Legal basis for processing: article 6 (1) (b) GDPR.
8. Please note that
1. The fact of data collection, the scope of the data processed and the the purpose of the processing:
The e-mail address does not need to contain any personal data.
2. Who is affected: All stakeholders sending a message via the contact form.
3. Duration of data processing, deadline for deletion of data: If one of the conditions set out in Article 17(1) of the GDPR is met, it shall continue until the data subject's request for erasure.
4. The identity of the potential controllers of the data, the recipients of the personal data: The personal data may be processed by authorised staff of the controller.
5. Description of data subjects' rights in relation to data processing:
6. The data subject may request access to, deletion, modification or restriction of processing of personal data, or the portability of data in the following ways:
7. Legal basis for processing: consent of the data subject, Article 6(1)(a), (b) and (c). By contacting us, you consent to the processing of your personal data (name, telephone number, e-mail address) in accordance with this Policy.
8. Please be informed that
1. The fact of collection, the scope of the data processed and the purpose of the processing:
2. Who is affected: All data subjects in contact with the controller by telephone/e-mail/in person or in a contractual relationship.
3. Duration of data processing, deadline for deletion of data: Letters containing requests will be kept until the data subject requests their deletion, but for a maximum of 2 years.
4. The identity of the potential controllers of the data, the recipients of the personal data: Personal data may be processed by authorised staff of the controller, in compliance with the above principles.
5. Description of data subjects' rights in relation to data processing:
6. The data subject may request access to, deletion, modification or restriction of processing of personal data, or the portability of data in the following ways:
7. Legal basis for processing:
7.1 Article 6(1)(b) and (c) of the GDPR.
7.2 In the event of enforcement of claims arising from the contract, the period of limitation shall be 5 years pursuant to § 6:21 of Act V of 2013 on the Civil Code.
§ 6:22 [Limitation period]
8. Please note that
1. The fact of collection, the scope of the data processed and the purpose of the processing:
2. Who is affected: All stakeholders who write reviews on this website.
3. Duration of data processing, deadline for deletion of data: It lasts until the data subject requests its deletion.
4. The identity of the potential controllers of the data, the recipients of the personal data: Personal data may be processed by authorised staff of the controller, in compliance with the above principles.
5. Description of data subjects' rights in relation to data processing:
6. The data subject may request access to, deletion, modification or restriction of processing of personal data, or the portability of data in the following ways:
7. Legal basis for processing:
7.1 Article 6(1)(a) of the GDPR.
A hajduszoboszlo.hu mobile application for the site does not collect or store any personal data.
1. Pursuant to Article 6 of Act XLVIII of 2008 on the Basic Conditions and Certain Restrictions of Economic Advertising Activity, the User may expressly consent in advance to the Service Provider contacting him/her with advertising offers and other mailings at the contact details provided at the time of registration.
2. In addition, the Customer may, subject to the provisions of this notice, consent to the processing of personal data by the Service Provider necessary for the sending of advertising offers.
3. The Service Provider will not send unsolicited commercial messages, and the User may unsubscribe from receiving such offers without any restriction and without giving any reason, free of charge. In this case, the Service Provider will delete all personal data necessary for sending advertising messages from its records and will not contact the User with further advertising offers. The User may unsubscribe from advertising by clicking on the link in the message.
4. The fact of data collection, the scope of the data processed and the the purpose of the processing:
5. Stakeholders: All stakeholders who subscribe to the newsletter.
6. Purpose of the processing: sending electronic messages (e-mail, SMS, push messages) containing advertising to the data subject, providing information on current information, products, promotions, new features, etc.
7. Duration of data processing, deadline for deletion of data: until the consent is withdrawn, i.e. until unsubscription.
8. The identity of the potential controllers of the data, the recipients of the personal data: Personal data may be processed by the sales and marketing staff of the controller, in compliance with the above principles.
9. Description of data subjects' rights in relation to data processing:
10. The data subject may request access to, erasure, modification or restriction of the processing of personal data, data portability or objection to the processing of personal data in the following ways:
11. The person concerned at any time, subscribe free of charge about the newsletter.
12. The data processor used for the processing:
MailChimp
The Rocket Science Group, LLC
675 Ponce de Leon Ave NE
Suite 5000
Atlanta, GA 30308 USA
13. Legal basis for processing: the consent of the data subject, Article 6 (1) (a) and (f) and Article 6 (5) of Act XLVIII of 2008 on the Basic Conditions and Certain Restrictions of Economic Advertising Activities:
The advertiser, the advertising service provider or the publisher of the advertisement shall keep a record of the personal data of the persons who have given their consent within the scope specified in the consent. The data recorded in this register, relating to the recipient of the advertising, may be processed only in accordance with the consent given in the consent form, until it is withdrawn, and may be disclosed to third parties only with the prior consent of the person concerned.
14. Please note that
1. Activity performed by a data processor: Delivery of products, transport
2. Name and contact details of the data processor:
3. The fact of processing, the scope of the data processed: Delivery name, delivery address, telephone number, e-mail address.
4. Stakeholders: All those requesting a home delivery are concerned.
5. Purpose of the processing: Delivery of the ordered product to your door.
6. Duration of data processing, deadline for deletion of data: It takes until the delivery is completed.
7. Legal basis for processing: Article 6(1)(b).
1. Activity performed by a data processor: Hosting service
2. Name and contact details of the data processor:
3. The fact of processing, the scope of the data processed: All personal data provided by the data subject.
4. Stakeholders: All stakeholders using the website.
5. Purpose of the processing: Making the website available and running it properly.
6. Duration of data processing, deadline for deletion of data: The data processing shall continue until the termination of the agreement between the data controller and the hosting provider or until the data subject's request for deletion to the hosting provider.
7. Legal basis for processing: Article 6(1)(c) and (f) and Article 13/A(3) of Act CVIII of 2001 on certain aspects of electronic commerce services and information society services.
1. The activity performed by the Recipient: Online payment
2. Name and contact details of the addressee:
3. The fact of data processing, the scope of the data processed: Billing details, name, e-mail address
4. Stakeholders: All data subjects who choose to pay on the website.
5. Purpose of the processing: Fraud-monitoring (checking for abuse) to process online payments, confirm transactions and protect users
6. Duration of data processing, deadline for deletion of data: It takes until the online payment is processed.
7. Legal basis for processing: Article 6(1)(b) of the GDPR. The processing is necessary for the purposes of making an online payment at the request of the data subject.
8. Rights of the data subject:
1. The fact of data collection, the scope of the data processed and the the purpose of the processing:
2. Who is affected: All data subjects concerned who make a complaint about the website and who make a complaint about its quality.
3. Duration of data processing, deadline for deletion of data: Copies of the record of the objection, the transcript and the reply to the objection shall be kept for 5 years pursuant to Article 17/A (7) of Act CLV of 1997 on Consumer Protection.
4. The identity of the potential controllers of the data, the recipients of the personal data: Personal data may be processed by the sales and marketing staff of the controller, in compliance with the above principles.
5. Description of data subjects' rights in relation to data processing:
6. The data subject may request access to, deletion, modification or restriction of processing of personal data, or the portability of data in the following ways:
7. Legal basis for processing: Article 6(1)(c) GDPR and Article 17/A(7) of Act CLV of 1997 on Consumer Protection.
8. Please note that
„recipient”: the natural or legal person, public authority, agency or any other body with whom or to which the personal data are disclosed, whether or not a third party.
The data controller uses data processors to facilitate its own data processing activities and to fulfil its contractual and legal obligations with data subjects.
The controller places great emphasis on using only processors that provide adequate guarantees to implement appropriate technical and organisational measures to ensure compliance with the requirements of the GDPR and to protect the rights of data subjects.
The processor and any person acting under the control of the controller or the processor who has access to the personal data shall process the personal data covered by this Policy only in accordance with the instructions of the controller.
The controller is legally responsible for the activities of the processor. A processor is liable for damage caused by processing only if it has failed to comply with the obligations specifically imposed on processors by the GDPR or if it has disregarded or acted contrary to lawful instructions from the controller.
The processor has no substantive decision-making power with regard to the processing of the data.
The data controller may use a hosting provider to provide the IT background and a courier service as a data processor to deliver the ordered products.
Data processing activities:
„third party”: a natural or legal person, public authority, agency or any other body other than the data subject, the controller, the processor or the persons who, under the direct authority of the controller or processor, are authorised to process personal data;
Third party data controllers process the personal data we provide on their own behalf and in accordance with their own privacy policies.
Activities of the Data Controller:
1. Cookies specific to webshops are the so-called „password-protected session cookies”, „shopping cart cookies”, „security cookies”, „essential cookies”, ”functional cookies” and „cookies responsible for the management of website statistics”, which do not require the prior consent of the data subject.
2. Fact of processing, scope of data processed: unique identifier, dates, times
3. Stakeholders: All data subjects visiting the website.
4. Purpose of the processing: Identify users, register the „shopping basket” and track visitors.
5. Duration of data processing, deadline for deletion of data:
6. Identity of the potential data controllers who may access the data: no personal data is processed by the data controller through the use of cookies.
7. Description of data subjects' rights in relation to data processing: data subjects have the possibility to delete cookies in the Tools/Preferences menu of their browsers, usually under the Privacy settings.
8. Legal basis for processing: consent is not required from the data subject where the sole purpose of the use of cookies is to provide a communication over an electronic communications network or where the service provider strictly needs the cookies to provide an information society service explicitly requested by the subscriber or user.
9. Most browsers used by our users allow you to set which cookies should be saved and allow (certain) cookies to be deleted again. If you restrict the saving of cookies on specific websites or do not allow third party cookies, this may in certain circumstances lead to our website no longer being fully usable. Here you will find information on how to customise your cookie settings for standard browsers:
Google Chrome (https://support.google.com/chrome/answer/95647?hl=hu)
Internet Explorer (https://support.microsoft.com/hu-hu/help/17442/windows-internet-explorer-delete-manage-cookies)
Firefox (https://support.mozilla.org/hu/kb/sutik-engedelyezese-es-tiltasa-amit-weboldak-haszn)
Safari (https://support.apple.com/kb/PH21411?locale=hu_HU)
1. The data controller uses the online advertising program „Google Ads (Adwords)” and makes use of Google's conversion tracking service within the framework of this program. Google Conversion Tracking is an analytics service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; „Google“).
2. When you visit a website through a Google ad, a cookie is placed on your computer for conversion tracking. These cookies have a limited validity and do not contain any personal data, so the User cannot be identified by them.
3. When the User browses certain pages of the website and the cookie has not expired, Google and the data controller may see that the User has clicked on the advertisement.
4. Each Google Ads (Adwords) client receives a different cookie, so they cannot be tracked through Ads (Adwords) clients' websites.
5. The information, which is obtained through the use of conversion tracking cookies, is used to provide conversion statistics for Ads (Adwords) customers who choose to track conversions. Customers are thus informed of the number of users who click on their ad and are referred to a page with a conversion tracking tag. However, they do not have access to information that would allow them to identify any user.
6. If you do not wish to participate in conversion tracking, you can opt out by disabling the option to set cookies in your browser. You will then not be included in the conversion tracking statistics.
7. Further information and Google's privacy statement can be found on the following page: www.google.de/policies/privacy/
1. This website uses Google Analytics, a web analytics service provided by Google Inc. („Google”). Google Analytics uses „cookies”, which are text files placed on your computer, to help the website analyze how users use the site you have visited.
2. The information generated by the cookies on the website used by the User is usually transferred to a Google server in the USA and stored there. By activating the IP anonymisation on the website, Google will previously shorten the IP address of the User within the Member States of the European Union or in other states party to the Agreement on the European Economic Area.
3. The full IP address will be transmitted to a Google server in the USA and shortened there only in exceptional cases. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity for the website operator and to provide other services relating to website activity and internet usage.
4. The IP address transmitted by the User's browser within the framework of Google Analytics will not be merged with other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You may also prevent Google from collecting and processing information about your use of this website (including your IP address) by means of cookies by downloading and installing the browser plug-in available at the following link. https://tools.google.com/dlpage/gaoptout?hl=hu
1. A Facebook account is code that allows the website to report conversions, create audiences and provide the site owner with detailed analytics on how visitors use the site. The Facebook remarketing pixel tracking code can be used to display personalised offers and ads to website visitors on Facebook. The Facebook remarketing list is not personally identifiable. For more information about Facebook Pixel / Facebook Account, click here: https://www.facebook.com/business/help/651294705016616
1.2. The data subjects: all data subjects who have registered on Facebook/Google+/Twitter/Pinterest/Youtube/Instagram etc. social networking sites and have „liked” the Service Provider's social networking site or contacted the data controller via the social networking site.
3. Purpose of data collection: to share, „like”, follow or promote certain content, products, promotions or the website itself on social networking sites.
4. Duration of data processing, time limit for deletion of data, the identity of the possible controllers entitled to access the data and the rights of the data subjects in relation to data processing: the data subject can find out about the source of the data, the processing of the data and the method and legal basis of the transfer on the relevant Community site. The data are processed on the social networking sites, so the duration of the processing, the way in which the data are processed and the possibilities for deleting and modifying the data are governed by the rules of the social networking site concerned.
5. Legal basis for processing: the data subject's voluntary consent to the processing of his or her personal data on social networking sites.
1. If the data subject has any questions or problems when using our services, he or she can contact the data controller by the means indicated on the website (telephone, e-mail, social networking sites, etc.).
2. The Data Controller deletes the data provided in e-mails, messages, telephone, Facebook, etc., together with the name and e-mail address of the interested party and other personal data voluntarily provided by the interested party, after a maximum of 2 years from the date of the communication.
3. Information about data processing not listed in this notice is provided at the time of collection.
4. In exceptional cases, the Service Provider shall be obliged to provide information, disclose data, hand over data or make documents available upon request of a public authority or other bodies authorised by law.
5. In such cases, the Service Provider will disclose personal data to the requester only to the extent and to the extent strictly necessary for the purpose of the request, provided that the requester has indicated the exact purpose and scope of the data.
You have the right to receive feedback from the controller as to whether or not your personal data are being processed and, if such processing is taking place, you have the right to access your personal data and the information listed in the Regulation.
You have the right to have inaccurate personal data relating to you corrected by the controller without undue delay at your request. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data, including by means of a supplementary declaration.
You have the right to have personal data concerning you erased by the controller without undue delay at your request, and the controller is obliged to erase personal data concerning you without undue delay under certain conditions.
If the controller has disclosed the personal data and is required to delete it, it will take reasonable steps, including technical measures, taking into account the available technology and the cost of implementation, to inform the controllers that process the data that you have requested the deletion of the links to or copies of the personal data in question.
You have the right to have the controller restrict processing at your request if one of the following conditions is met:
You have the right to receive the personal data concerning you that you have provided to a controller in a structured, commonly used, machine-readable format and the right to transmit these data to another controller without hindrance from the controller to whom you have provided the personal data (...)
In the case of processing based on legitimate interest or public authority as legal grounds, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data by (...), including profiling based on those provisions.
Where personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such purposes, including profiling, where it is related to direct marketing. If you object to the processing of your personal data for direct marketing purposes, your personal data may no longer be processed for those purposes.
You have the right not to be subject to a decision based solely on automated processing, including profiling, which would have legal effects concerning you or similarly significantly affect you.
The preceding paragraph shall not apply in the case where the decision:
The controller shall, without undue delay and in any event as soon as possible after receipt of the request. within 1 month inform you of the action taken on these requests.
If necessary, this may be extended by 2 months. The data controller shall inform the applicant of the extension of the time limit, stating the reasons for the delay, within within 1 month will inform you.
If the controller does not act on your request, inform you of the reasons for the non-action without delay and at the latest within one month of receipt of the request, and that you can lodge a complaint with a supervisory authority and exercise your right to judicial redress.
The controller and the processor shall implement appropriate technical and organisational measures, taking into account the state of the art and the cost of implementation, the nature, scope, context and purposes of the processing and the varying degrees of probability and severity of the risk to the rights and freedoms of natural persons, in order to ensure a level of data security appropriate to the level of risk, including, where appropriate:
physical protection
b. IT security
Where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall inform the data subject of the personal data breach without undue delay.
In the information given to the data subject in a clear and understandable way describe the nature of the personal data breach and provide the name and contact details of the Data Protection Officer or other contact person who can provide further information; describe the likely consequences of the personal data breach; describe the measures taken or envisaged by the controller to remedy the personal data breach, including, where appropriate, measures to mitigate any adverse consequences of the personal data breach.
The data subject need not be informed if any of the following conditions are met:
If the controller has not yet notified the data subject of the personal data breach, the supervisory authority may, after having considered whether the personal data breach is likely to present a high risk, order the data subject to be informed.
The data protection incident shall be notified by the controller to the supervisory authority competent under Article 55 without undue delay and, if possible, no later than 72 hours after the data protection incident has come to its attention, unless the data protection incident is unlikely to pose a risk to the rights and freedoms of natural persons. If the notification is not made within 72 hours, it shall be accompanied by the reasons justifying the delay.
Complaints against possible infringements by the data controller can be lodged with the National Authority for Data Protection and Freedom of Information:
The following legislation has been taken into account in the preparation of this information:
Privacy incident report
Informing stakeholders about the data breach
Right of withdrawal sample declaration
Consent under GDPR
Declarations of cancellation
Sample complaint record
Warranty management protocol sample
Hajdúszoboszló, 2019. május 09.
