Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, hereinafter: “GDPR”), the Data Controller hereby informs you, through this Privacy Notice and process description, of all relevant facts regarding the processing of your personal data. By participating in the processes described herein, you, as a data subject, become subject to data processing in accordance with this Privacy Notice.
Data Controller
Name: Ambient Vendégház és Kávéház Kft.
Registered office: 8360 Keszthely, Pázmány Péter u. 37., Hungary
Postal address: 8360 Keszthely, Pázmány Péter u. 37., Hungary
Website: www.secret-garden.hu
Email: [email protected]
Phone: +36 70 792 7023
Data Processing Related to Website Visitors (Google Analytics)
Purpose of Data Processing
The Data Controller processes data related to website visits for the purpose of operating the website, measuring performance, improving user experience and preparing statistical analyses, using the Google Analytics service.
Legal Basis for Data Processing
The legal basis for data processing is the data subject’s voluntary consent pursuant to Article 6(1)(a) of the GDPR, which is provided by accepting the cookie settings displayed on the website.
Consent may be withdrawn at any time by modifying the cookie settings.
Scope of Processed Personal Data
When using Google Analytics, the following data may be processed:
IP address,
date and duration of the visit,
visited subpages,
geographical data (country, city level),
technical data of the visitor’s device (browser type, operating system).
The Data Controller does not use the data collected by Google Analytics to identify the data subject and does not link them to other personal data records.
Data Processor and Data Transfers
Data processor:
Google LLC – provider of the Google Analytics service.
In connection with the use of Google Analytics, personal data may be transferred outside the European Union. Such data transfers are carried out in accordance with applicable legal requirements and appropriate safeguards (e.g. Standard Contractual Clauses approved by the European Commission).
Data Retention Period
The retention period of data processed by Google Analytics is determined in accordance with the Google Analytics settings and lasts only for the period necessary to achieve the data processing purpose.
Automated Decision-Making
No automated decision-making or profiling is carried out through the use of Google Analytics that would produce legal effects concerning the data subject.
Data Processing Related to the Operation of the Electronic Surveillance System (CCTV)
Purpose of Data Processing
The purpose of video surveillance is the protection of persons and property in the parking area and at the reception.
Legal Basis for Data Processing
The legal basis for data processing is the legitimate interest of the Data Controller pursuant to Article 6(1)(f) of the GDPR.
Scope of Processed Personal Data
Image of the data subject and data obtainable from camera footage (location and duration of presence).
Personal data are not transferred to third parties, except where disclosure is required by law (e.g. to courts or authorities).
Data Retention Period
In the absence of use, recordings are deleted after 30 days from the date of recording.
Automated Decision-Making
No automated decision-making takes place.
Data Processing Procedure
The Data Controller operates an electronic surveillance system for property protection purposes in accordance with Act CXXXIII of 2005 on personal and property protection and private investigation activities.
Access to recordings is restricted to authorised persons only, and all access and restriction activities are documented in accordance with legal requirements.
Data Processing Related to Guest Services
Purpose of Data Processing
The Data Controller processes personal data to the extent necessary for the provision of accommodation and related services.
Legal Basis for Data Processing
Performance of a contract pursuant to Article 6(1)(b) of the GDPR.
Scope of Processed Personal Data
Surname and given name – identification and communication
Email address – communication
Phone number – communication
Information related to the handling of the guest’s request
Personal data are not transferred to third parties, except where required by law.
Data Retention Period
Personal data processed for reporting purposes are retained until the last day of the year following the date of acquisition, after which they are deleted.
Data transmitted to the VIZA system may be retained for up to two years.
Data Processing Related to Registration and Further Use of Data
Purpose of Data Processing
In order to use the services of the Data Controller, the data subject must complete an online or paper-based registration form. Data provided may be reused to facilitate the provision of services in the future.
Legal Basis for Data Processing
performance of a contract pursuant to Article 6(1)(b) of the GDPR;
compliance with a legal obligation pursuant to Article 6(1)(c) of the GDPR, where required by law.
Scope of Processed Personal Data
Name
Nationality
ID document number
Email address
Phone number
Full residential address
Billing address
Payment method
Order fulfilment data
Data Retention Period
Personal data are deleted 2 years after termination of the relationship, unless a longer retention period is required by law.
Accounting-related documents are retained for 8 years in accordance with Act C of 2000 on Accounting.
Data Processing Related to Gift Card Orders
(Ez a rész megegyezik az előző üzenetben megadott angol fordítással – nem ismétlem, hogy elkerüljük az eltéréseket.)
Rights of Data Subjects
After verifying their identity, data subjects may exercise the following rights under the GDPR:
right of access,
right to rectification,
right to erasure,
right to restriction of processing,
right to data portability,
right to withdraw consent.
Requests should primarily be submitted in writing using the contact details provided above.
The Data Controller responds within one month, which may be extended by up to two additional months if justified.
If the Data Controller fails to act on the request or the data subject disagrees with the response, the data subject may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or initiate court proceedings before the competent court.