Privacy Policy
Fundus Invest Kft.
External Privacy Policy
Fundus Invest Kft. (registered office: 4200 Hajdúszoboszló, József Attila u. 5-7, company registration number: 09-09-019876, tax ID number: 22990136-2-09, phone number: Tuba Farm: 21/350-0444, 30/300-2988; Villa Cuvée: 21/350-0222, Hotel Délibáb: 21/350-0777, 52/360-366; Mirage Restaurant: 52/898-151, e-mail: info@tubatanya.hu, info@villacuvee.hu, info@hoteldelibab.hu, info@mirage-etterem.hu, represented independently by Éva Czene, Managing Director), as the data controller, hereby provides you with a brief summary of the data processing activities it carries out.
The Data Controller would like to draw the attention of the data subjects to the fact that
- data subjects may exercise their rights (the right of access, the right to rectification, the right to erasure and the right to be “forgotten,” the right to restrict processing, the right to object, and the right to data portability) by sending a statement to the email addresses info@tubatanya.hu, info@villacuvee.hu, info@hoteldelibab.hu, info@mirage-etterem.hu, or by sending a statement to any other contact information provided by the Data Controller; furthermore, in the event of a violation of their rights, they may file a complaint with the authority (for current contact information, see: NAIH, www.naih.hu) or to the court with jurisdiction over their place of residence and may claim compensation for damages. The Data Controller draws the attention of data subjects to the fact that the exercise of their rights may be subject to conditions and limitations in connection with specific data processing activities, which the Data Controller is obligated to examine when data subjects exercise their rights. In the event that a data subject cannot exercise a right in connection with a specific data processing activity, the Data Controller shall inform the data subject in writing (including by electronic means) of the factual and/or legal grounds precluding or limiting the exercise of that right and shall maintain a record thereof.
- more detailed explanations of each data processing activity can be found in Appendix I of the Internal Data Protection Policy.
- Profiling is conducted exclusively within the framework of the Hotel Délibáb Loyalty Program: the Data Controller classifies data subjects into membership tiers based on the number of reservations made by Club Members and the amount spent, solely for the purpose of providing the benefits specified in the Program. This profiling has no legal effect on the data subject and does not result in automated decision-making. No profiling takes place in connection with any other data processing activities.
- data may be disclosed to third parties in connection with a specific data processing activity, as set forth in the detailed information notice for that activity; and if data is disclosed in connection with any of the data processing activities specified below, the recipient of the disclosure (data controller or data processor) is identified in Annex II.
- a separate cookie policy has been established.
- the following summary covers all data processing activities carried out by the Data Controller, except for those that apply exclusively to the Data Controller’s employees.
Summary Table of Data Processing for One-Time Requests for and Provision of Information |
||||||
| Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| providing the data subject with appropriate information and maintaining contact accordingly | voluntary consent, compliance with a legal obligation, a contractual basis, a legitimate interest, or a vital interest | Any natural person, including a representative acting on behalf of an organization, who comes into contact with the Data Controller and requests or receives information from the Data Controller | Further details can be found in the data processing notice/description | until the purpose is fulfilled, or until a request for erasure is made, or
within the time limit specified by law, or until the statute of limitations expires, or until the legitimate interest ceases to exist |
electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processed in the Course of Ongoing, Regular Communication with Data Subjects |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| maintaining contact with the affected party; responding to and resolving any questions, requests, and other matters that arise | voluntary consent, compliance with a legal obligation, a contractual basis, a legitimate interest, a legal obligation, or a vital interest | Any natural person—including a natural person acting on behalf of or in representation of an organization—who, beyond a one-time request for information, maintains ongoing or regular contact with the Data Controller | Further details can be found in the data processing notice/description | until the purpose is fulfilled, or until a request for erasure is made, or
within the time limit specified by law, or until the statute of limitations expires, or until the legitimate interest ceases to exist |
electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing Related to the Request for Proposals Issued by the Data Subject and the Proposal Submitted by the Data Controller |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| providing the data subject with an appropriate offer and maintaining contact | voluntary consent, or Article 6(1)(b) of the GDPR | Any natural person—including a natural person acting on behalf of or in representation of an organization—who requests an offer from the Data Controller and provides their personal data | Further details can be found in the data processing notice/description | during the period of validity, or, if consent is given, until the legal relationship expires, or, in the case of data processing based on a legitimate interest, until such interest ceases to exist | electronically and/or on paper, typically electronically, and is done manually | Data Subjects |
Data processing related to calls for proposals issued by the data controller and the submission of proposals in response thereto |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Submitting a proposal in response to a call for proposals from the Data Controller and maintaining contact | Voluntary consent, the data controller’s legitimate interest, or compliance with a legal obligation | Further details can be found in the data processing notice/description | Further details can be found in the data processing notice/description | If accepted, 8 years; if not accepted, for the duration of validity or by the deadline specified in the relevant legislation or call for proposals | Electronically, on paper, manually | Data Subjects |
Summary Table of Data Processing Related to the Conclusion of an Agreement |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| concluding the agreement, fulfilling it, monitoring its fulfillment, and maintaining contact | Conclusion of an Agreement (GDPR Article 6(1)(b))
The processing of representatives' and contact persons' data is based on legitimate interests |
Any natural person, as well as any natural person acting on behalf of or representing an organization, who enters into an agreement with the Data Controller in their own name—provided they have provided their personal data—or who is listed in the contract as a representative or contact person | Further details can be found in the data processing notice/description | statute of limitations or
the term specified in the agreement, or cannot be discarded, so it cannot be deleted |
electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing for Appointment Scheduling (Booking Appointments) |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| scheduling appointments for the data subject and maintaining contact | based on voluntary consent | Any natural person—including a natural person acting on behalf of or in representation of an organization—who books or schedules an appointment by providing their information | Further details can be found in the data processing notice/description | until the purpose is fulfilled, or until the general statute of limitations expires, or until the legitimate interest ceases to exist | electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing Related to Consent Statements |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| the ability to demonstrate the legal basis for data processing, as well as the fulfillment of consent and maintaining contact. | voluntary consent | Any natural person who provides the Data Controller with a statement consenting to the processing of their data for any purpose | Further details can be found in the data processing notice | until consent is withdrawn or the data is deleted
Consent statements will be deleted after the statute of limitations following the withdrawal has expired |
electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing Activities Involving the Creation of Photographs, Video Recordings, and Audio Recordings of the Data Subject with the Data Subject’s Consent |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| az érintett hozzájárásulásában meghatározott cél | voluntary consent | any natural person who gives prior consent to having photographs, videos, and/or audio recordings made of them | Further details can be found in the data processing notice | until deleted at the request of the data subject | electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing Related to the Handling of Claims and Complaints |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Identifying the affected party and the complaint, as well as handling the complaint and maintaining communication | It is based on voluntary consent, but pursuant to Article 6(1)(c) of the GDPR, the processing is necessary for compliance with a legal obligation to which the data controller is subject, in accordance with Section 17/A(7) of Act CLV of 1997 on Consumer Protection. | Any natural person who submits a complaint regarding a service received, a product purchased, and/or the Data Controller’s conduct, actions, or omissions | Further details can be found in the data processing notice/description | The data controller retains the record of the complaint and a copy of the response for 5 years from the date of their creation, in accordance with the Consumer Protection Act. | electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing Related to the Registry of Data Subjects (Customers and Partners) |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| identifying the data subject, maintaining contact with them, and monitoring the fulfillment of the agreement (if applicable) | based on voluntary consent, or on an agreement, or is necessary for the performance of a legal obligation, or based on a legitimate interest | Any natural person, as well as the representative of a non-natural person, who is a Partner/customer of the Data Controller, or who wishes to become a Partner/customer, or who is an Employee | Further details can be found in the data processing notice/description | until deleted at the request of the data subject,
deletion due to unsuccessful data reconciliation, until deletion due to the death of the person concerned, or if it is for the Data Controller's interest, until such interest ceases to exist. The data controller may designate the record as having permanent value; therefore, the data contained therein may not be deleted. |
electronically (on paper), manually | Data subjects, or possibly a partner |
Summary Table of Data Processing Related to the Registration of Data Subjects (Regular Customers) |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| As part of the Hotel Délibáb Loyalty Program, identifying data subjects, granting and verifying their membership eligibility, assigning them to a membership tier, providing tier-based discounts, informing data subjects about discounts, promotions, and other offers available exclusively to Club Members, and maintaining contact | is based on voluntary consent, or on an agreement, or on a legitimate interest (if the contact person/representative of the data subject has entered into an agreement with the Data Controller) | Any natural person who has registered in accordance with the terms and conditions set forth in the Hotel Délibáb Loyalty Program Rules and has become a Club Member | For more details, see the data processing notice/description and the Hotel Délibáb Loyalty Program Rules and Regulations | in accordance with the 365-day validity period specified in the Hotel Délibáb Loyalty Program Terms and Conditions, and thereafter until the membership level is reviewed; in the event of termination of membership, until deletion at the request of the member; in the event of termination due to unsuccessful data verification or misuse, until deletion, taking into account the statute of limitations | electronically, manually | Data Subjects |
The detailed terms and conditions of the Hotel Délibáb Loyalty Program, the membership tiers, and the associated discounts are set forth in the Hotel Délibáb Loyalty Program Rules, which are available at: https://hoteldelibab.hu/torzsvendeg-program/torzsvendeg-program-szabalyzat
Summary Table of Data Processing Related to Landline Phone Calls |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| quality improvement, monitoring of customer relations, and the documentation and more effective resolution of stakeholder and user needs and issues | voluntary consent | Any natural person—including a natural person acting on behalf of or in representation of an organization—who wishes to contact the Data Controller or maintain contact with the Data Controller through the landline customer service line | Further details can be found in the data processing notice/description | For 6 months; in the event of a complaint, for 5 years pursuant to Act CLV of 1997 | electronically, automatically | Data Subjects |
The detailed terms and conditions of the Hotel Délibáb Loyalty Program, the membership tiers, and the associated discounts are set forth in the Hotel Délibáb Loyalty Program Rules, which are available at: https://hoteldelibab.hu/torzsvendeg-program/torzsvendeg-program-szabalyzat
Summary Table of Data Disclosure (to Third Parties) |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Unique purpose | consent, compliance with a legal obligation, agreement, legitimate interest | Any natural person, including a natural person acting on behalf of or in representation of an organization, whose data is disclosed by the Data Controller to a third party | Further details can be found in the data processing notice/description | Until the purpose is fulfilled, or until the statute of limitations expires, or until the deadline specified by law, or until the legitimate interest ceases to exist | This is done electronically and/or on paper, manually, in compliance with data security requirements and the principle of confidentiality | Data subjects, data processors, official registry |
Summary Table of Data Processing Related to Room Reservations |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| processing the accommodation reservation request, booking the accommodation by linking it to the data subject, and maintaining contact with the data subject | voluntary consent | Any natural person who books a room at an accommodation facility operated by the Data Controller by providing their personal data | Further details can be found in the data processing notice | In the event of a no-show, the reservation is canceled immediately; otherwise, it expires after the applicable period. | electronically, on paper, manually | data subjects, or possibly a Partner (travel agency/tour operator) |
Summary Table of Data Processing Related to Check-In and the Check-In Form/Guest and Tourism Registry |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| to ensure full compliance with the law; to establish the accommodation service contract and provide evidence of its conclusion and fulfillment; and to handle any claims and maintain contact with the data subject | compliance with a legal obligation, legitimate interest, voluntary consent, entering a contract | Any natural person who checks in at an accommodation facility operated by the Data Controller by providing their personal data and filling out a registration form or guest register | see the registration form/guest register | Further details can be found in the data processing notice | electronically, on paper, manually | data subjects, or possibly a Partner (travel agency/tour operator) |
Accommodation Reservations Made by the Data Controller on Behalf of a Third Party |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Ordering a taxi for the data subject to a specified location and time, and maintaining contact with the data subject | Voluntary consent | Any natural person for whom the Data Controller orders a taxi | Further details can be found in the data processing notice | Further details can be found in the data processing notice | Electronically, manually | Data subject, or possibly a partner |
Summary Table of Data Processing Related to Table Reservations |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| reserving a table, identifying the data subjects, and maintaining contact | based on voluntary consent | Any individual who wished to reserve a table by providing their information | Further details can be found in the data processing notice/description | until the purpose is fulfilled | electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing Related to Camp Activities |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Identifying data subjects, determining their eligibility to use the service in question, entering into an agreement, providing and fulfilling the service, and, if necessary, maintaining contact | Voluntary consent or the signing of an agreement (GDPR Article 6(1)(b))
Legitimate interest in the processing of representative/contact person data |
Any natural person whose data is provided to the Data Controller by the data subject in connection with requesting services related to camps organized by the Data Controller or entering into a contract. Data subjects include, in particular, children and their legal representatives. | Further details can be found in the data processing notice/description | until the purpose is achieved or for 5 years | electronically, on paper, manually | Data Subjects |
Summary Table of Data Processing Related to Health Status |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Providing appropriate services to the individual concerned and maintaining contact | voluntary consent | Any natural person who shares health data with the Data Controller | Further details can be found in the data processing notice | primarily until the objective is achieved, or
until revoked, but no longer than the statute of limitations |
electronically, on paper, manually | Data Subjects |
Summary Table of Data Processing Related to Bank Information and Bank Transfers |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Facilitating and Monitoring Financial Transaction Completion | compliance with a legal obligation and/or an agreement, or voluntary consent | Any natural person to whom a bank transfer initiated by the Data Controller is made, as well as any natural person who wishes to make a financial payment to the Data Controller via a bank transfer | Further details can be found in the data processing notice/description | Until the statute of limitations expires or by the deadline specified by law | Done electronically, manually, or automatically | from our own records, from the data subjects |
Summary Table of Data Processing Related to Invoicing |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| compliance with a legal obligation | Compliance with legal obligations under Act CXXVII of 2007 on Value-Added Tax and the regulations issued pursuant to that Act | any natural person, including sole proprietors, whose information appears on an invoice (or an accounting document deemed equivalent) issued by the Data Controller (even if it appears in a “remarks,” “notes,” or similar field) | The categories of data set forth in Sections 169–170 and Section 176 of Act CXXXVII of 2007 | 8 years | on paper/electronically, manually | data subjects; rarely official records |
Summary Table of Data Processing Related to Invoice Receipt |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| full compliance with legal obligations; retention of invoices (and documents deemed equivalent thereto) pursuant to Section 179 of Act CXXVII of 2007 | jogi kötelezettség teljesítése (2007. évi CXXVII. tv. 179. §) | minden természetes személy, akinek adata az Adatkezelő által befogadott számlára (vagy azzal egy tekintet alá eső számviteli bizonylatra) vagy mellékletére rákerült | The categories of data set forth in Sections 169–170 and Section 176 of Act CXXXVII of 2007 | 8 years | on paper/electronically, manually | invoicing party |
Summary Table of Camera System Operations |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Purposes specified in the camera policy, such as property protection, protection of personal safety and physical well-being, etc., and identification of data subjects | the Data Controller's legitimate interest | Any natural person who enters or remains in an area monitored by a surveillance camera system | Further details can be found in the data processing notice/description | 8 days from the date of recording | electronically, automatically | Data Subjects |
Summary Table of Data Processing Related to the Operation of an Electronic Access Card System |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Identifying data subjects, granting and verifying their access rights, and ensuring personal and property protection and security | the Data Controller's legitimate interest | Any natural person to whom the Data Controller issues a device (e.g., a card) that grants access | Further details can be found in the data processing notice/description | Records must be deleted 180 days after the right to regular entry expires; in the case of occasional entry (when a guest card is issued), records must be deleted 1 day after departure | electronically, automatically | Data Subjects |
Summary Table of Data Processing Related to the Sending of Newsletters |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Providing the recipient with comprehensive, general, or personalized and regular information about the Data Controller’s latest promotions, events, and news | based on voluntary consent | Any natural person who wishes to receive regular updates about the Data Controller’s news, promotions, and discounts and who, for this purpose, subscribes to the newsletter service by providing their personal data | Further details can be found in the data processing notice/description | Until cancellation | Sign-up electronically or on paper, manually
sending electronically, automatically cancellation can be done electronically or on paper, manually. |
Data Subjects |
Summary Table of Data Processing Related to the Organization of a Prize Contest |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| enabling participation, identifying participants during the drawing, and maintaining contact | voluntary consent | any natural person who wishes to participate in a sweepstakes organized by the data controller by providing their personal data | Further details can be found in the data processing notice | until the objective is achieved or the statute of limitations expires | application submitted electronically, on paper, or manually
The prize draw can be conducted automatically or manually (depending on the type of draw) |
Data Subjects |
Fundus Invest Kft. Sweepstakes Rules
The sweepstakes conducted in accordance with these rules is organized by Fundus Invest Kft. (registered office: 4200 Hajdúszoboszló, József Attila u. 5-7., company registration number: 09-09-019876, tax ID: 22990136-2-09, phone number: 52/360-366, email: info@hoteldelibab.hu, represented by Éva Czene, managing director, hereinafter referred to as the “Organizer”) independently organizes the sweepstakes in accordance with these rules:
- The Organizer is the data processor and data controller for the sweepstakes. During the duration of the sweepstakes, the rules will be available to all users on the https://hoteldelibab.hu/ website. The Organizer will post any amendments to the rules, as well as any notice regarding the termination of the sweepstakes, on this website.
- Any decision made by the Organizer of the sweepstakes regarding this contest is final and binding in all respects; no legal action may be brought in connection with such decisions. The Organizer excludes the possibility of any user of the website or participant in the contest asserting any claim against the Organizer on any grounds whatsoever.
- The organizer reserves the right to cancel or suspend the game, or to withhold prizes in whole or in part, if there is suspicion of abuse or a violation of the terms and conditions in connection with the game, or in the event of force majeure.
- The Organizer reserves the right to supplement or modify the rules of the game or the game itself, but is required to notify website users and game participants of such changes via the website.
- Participation in the promotional game constitutes an understanding and acceptance of the rules in effect at any given time.
I. Defining the game
- 1 Gift Certificate (see: the “Prizes” section) will be awarded to the person who uploads a photo to the “TAKE A PHOTO AND WIN” post published by the Organizer of the promotional contest on the Hotel Délibáb Facebook page (https://www.facebook.com/HotelDelibabHajduszoboszlo) and whose uploaded photo receives the most “likes.”
- Based on the above, the Organizer is entitled to verify the number of “likes” received on the photos.
- The duration of the game:
The first round of the contest, which involves uploading photos, runs from December 21, 2020, until 12:00 a.m. on December 27, 2020. The second round of the contest runs from December 28, 2020, through January 4, 2021, during which time participants can collect “likes” on the photos they’ve uploaded and organized into an album. The winner of the contest will be the person who uploaded the photo with the most “likes.” The Organizer will notify the Winner via a public Facebook post no later than January 10, 2021, and will ask the Winner to contact the Organizer to arrange delivery of the prize.
II. Conditions of participating in the game:
- Any natural person who meets the requirements set forth in Section I may participate in the sweepstakes, with the following exceptions:
a. the Organizer’s senior officers, employees, agents, and the close relatives of such persons as defined in the Civil Code currently in force; and
b. senior officers, employees, and agents of the individuals and companies involved in the preparation and conduct of the sweepstakes on behalf of the Organizer, as well as the close relatives of such individuals as defined in the Civil Code currently in force.
IV. How the game works
- The organizer asks participants to upload their photos to the contest via the Hotel Délibáb Facebook page (https://www.facebook.com/HotelDelibabHajduszoboszlo) by December 27, 2020, in response to the post published on December 21, 2020.
- The Organizer will create a photo album from the photos uploaded by December 27, 2020, and publish it in a post. The photos collected in the album can receive “Likes” between December 28, 2020, and January 4, 2021.
- The person who uploaded the photo with the most likes by January 4, 2021, will win the prize specified in Section V of these contest rules.
- The winner may claim the prize only by responding to the confirmation email/electronic message/other communication received from the Organizer: the winner must confirm their participation in the contest and acceptance of the prize within 5 days of receiving the email notification/electronic message/other communication.
- If
a. the deadline has passed without a result, or
b. the provided email address is incorrect, does not exist, or we were unable to contact the recipient after three attempts, or
c. the winner informs the Organizer that they did not participate in the contest, or
d. If the winner does not wish to accept the prize, the alternate winner will be notified. In this case, the person who uploaded the photo with the next highest number of “Likes” will be announced as the alternate winner, as described above.
6. If
a. the deadline regarding the substitute winner has passed without a result, or
b. the provided email address is incorrect, does not exist, or we were unable to contact the recipient after three attempts, or
c. the substitute winner informs the Organizer that they did not participate in the contest, or
d. If the winner does not wish to accept the prize, the Organizer will hold a drawing to award the prize among those who uploaded a photo by the deadline described above.
7. The winner will receive the prize electronically via email, electronic message, or another agreed-upon method of contact.
V. The prize
- The prize for the promotional contest:
1 Gift Certificate with the following details and validity period:
✅Accommodation for 1 night for 2 people in a Classic Room with a balcony
✅Use of the room and wellness facilities until 3:00 p.m. on the day of departure
✅ Buffet breakfast and dinner as part of the half-board plan
✅Unlimited access to the Délibáb Wellness Oasis & Thermal Spa during business hours:
✅Indoor adventure pool (30–32°C) with a hot tub and a lazy river
✅ Separate thermal pools with medicinal water at temperatures of 32–34°C and 36–38°C ✅ Sauna area: bio and Finnish saunas, plunge pool, ice fountain, and tropical shower
✅ Steam room and relaxation room with salt bricks
✅ baby paddling pool (20 cm deep, approx. 32 °C)
✅1 afternoon coffee or tea and a pastry
✅Use of the indoor play area: double wave slide with a ball pit, donut swing, logic games
✅Gym with cardio machines
✅ Bathrobe and slippers for the duration of the stay
✅ Free Wi-Fi in the rooms and common areas
✅ Parking - The gift certificate is valid from January 10, 2021, through December 23, 2021 (excluding peak periods and holidays)
- The prize cannot be exchanged for another product or redeemed for cash.
VI. Data Protection
- With regard to data protection, the Organizer has adopted a Data Protection and Data Security Policy.
- The rules governing data management and data processing related to the sweepstakes are set forth in the current Data Protection and Data Security Policy.
- The current Privacy and Data Security Policy is available on the https://hoteldelibab.hu/ website.
- In these Rules, the Organizer also draws participants’ attention to the fact that the legal basis for the processing of their data is the voluntary participation of the participants, as data subjects in the contest, through their voluntary participation, their review of these contest rules and the Privacy and Data Security Policy, and their acceptance thereof through participation; the purpose of such processing is to identify the winner and to maintain contact.
- The organizer may make the winner’s name available to third parties on the Hotel Délibáb Facebook page; therefore, it urges users of the Hotel Délibáb Facebook page to consider this fact when deciding whether to participate in the promotional contest.
- Given that participation in the game is free (not tied to placing bets), and that participation is contingent upon liking and sharing photos posted on a social media site, this activity does not fall under the scope of Act XXXIV of 1991 on the Organization of Gambling, is not subject to a license, and is not subject to a reporting requirement. Should the Organizer incur any tax liability arising from the organization of this prize contest, it shall not pass such liability on to the participants or the winners but shall bear it itself.
Summary Table related to Event Planning |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| carrying out tasks related to organizing the event and maintaining contact with the data subjects | based on voluntary consent, an agreement, or a legitimate interest | Any individual who attends an event or uses event planning services | Further details can be found in the data processing notice/description | statute of limitations | electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing Related to Gift Certificates (Coupons) |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Enabling the purchase of gift certificates/coupons and their redemption when purchasing the Data Controller’s services/products; maintaining contact | voluntary consent, legitimate interest, agreement | Any natural person who wishes to purchase or redeem a gift certificate or coupon in connection with one of the Data Controller’s services or products | Further details can be found in the data processing notice/description | validity period
if exchanged, the statute of limitations 5 years for receipts |
electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing Related to Customer Satisfaction Surveys |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| to improve the quality of services, products, and the Data Controller’s conduct; to investigate any complaints; and to maintain contact | the Data Controller's legitimate interest | Any natural person who participates in a customer satisfaction survey as part of the Data Controller’s quality assurance process | Further details can be found in the data processing notice/description | Until the objective is achieved, or for 5 years in the event of a complaint | electronically and/or on paper, done manually | internal record of data subjects |
Summary Table of Data Processing Related to Social Media Marketing |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| The Data Controller's marketing activity | Voluntary consent | Natural persons who voluntarily follow, share, or like the Data Controller’s social media page or the content posted on it | Further details can be found in the data processing notice/description | Until deletion at the request of the data subject or until the legitimate interest ceases to exist | Done electronically, manually | Data Subjects |
Summary Table of Data Processing Related to the Guestbook |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| to allow the data subject to express their opinion regarding the Data Controller’s services in order to improve the quality of those services and to inform others, as well as to enable the Data Controller to contact the data subject regarding any complaints | voluntary consent, in the event of a complaint | Any natural person who wishes to share their opinion with the Data Controller and others through the guestbook | Further details can be found in the data processing notice | Until deleted at the request of the data subject; in the event of a complaint, for 5 years (pursuant to Act CLV of 1997) | electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing Related to the Handling of Job Applicants' Data |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Application and Selection Process, and Communication | Voluntary consent | Any natural person who applies for a job opening advertised by the Data Controller, or who applies without a specific job opening being advertised | Further details can be found in the data processing notice/description | for the period specified in the written consent or until the legitimate interest ceases to exist | Electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing Related to Aptitude Tests |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
|
Assessment of the professional qualifications (competencies) necessary to exercise the rights and fulfill the obligations specified in the rules governing the legal relationship |
voluntary consent or legitimate interest |
Any natural person who participates in a competency test |
Further details can be found in the data processing notice/description |
Until a request for deletion is made, or until the period specified in the consent, or until the statute of limitations expires |
electronically and/or on paper, done manually |
Data Subjects |
Summary Table of Data Processing Related to Language Proficiency Assessment Tests |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Identifying the specific language level of the applicant to ensure the most effective language learning | voluntary consent | Any natural person who takes the language proficiency assessment test | Further details can be found in the data processing notice | ntil the purpose is fulfilled, or until the data subject requests erasure, or—if the data subject is assigned to a specific group—on the basis of a legitimate interest (for the purposes of subsequent comparison and to reinforce language development)—the duration of data processing corresponds to the duration of the language training; subject to the statute of limitations | electronically, on paper, manually | Data Subjects |
Fundus Invest Kft. record of data processors and recipients of data transfers
Fundus Invest Kft. (Headquarters: 4200 Hajdúszoboszló, József Attila St. 5-7, Company Registration No.: 09-09-019876, Tax ID: 22990136-2-09, phone numbers: Tuba Tanya: 21/350-0444, 30/300-2988; Villa Cuvée: 21/350-0222, Hotel Délibáb: 21/350-0777, 52/360-366; Mirage Restaurant: 52/898-151, email: info@tubatanya.hu, info@villacuvee.hu, info@hoteldelibab.hu, info@mirage-etterem.hu, represented independently by Éva Czene, Managing Director), as the data controller, hereby informs data subjects of the following:
The Data Controller’s data processor, which has been entrusted with performing outsourced auditing tasks:
Name: AUDIT TEAM 2000 KFT. | Judit Pétisné Mészáros
Székhely: 4026 Debrecen, Péterfia utca 46. Fszt. 1.
Elérhetőségi adatok: +36 52 410 038
Adatkezelő tárhelyszolgáltatás feladatával megbízott adatfeldolgozója:
Név: MADE BY NARO BT.
Székhely: 4225 Debrecen, Kiserdő u. 11.
Elérhetőségi adatok: +36 30 326 6590 | info@naro.hu
Adatkezelő call center szolgáltatás hangrögzítéssel feladatával megbízott adatfeldolgozója:
Név: ARENIM TECHNOLOGIES KFT.
Székhely: 1117 Budapest, Infópark sétány1.
Elérhetőségi adatok: +36 1 855 5666 | support@arenimtel.com
Subscribe to Newsletter
Privacy Policy
Fundus Invest Kft.
External Privacy Policy
Fundus Invest Kft. (registered office: 4200 Hajdúszoboszló, József Attila u. 5-7, company registration number: 09-09-019876, tax ID number: 22990136-2-09, phone number: Tuba Farm: 21/350-0444, 30/300-2988; Villa Cuvée: 21/350-0222, Hotel Délibáb: 21/350-0777, 52/360-366; Mirage Restaurant: 52/898-151, e-mail: info@tubatanya.hu, info@villacuvee.hu, info@hoteldelibab.hu, info@mirage-etterem.hu, represented independently by Éva Czene, Managing Director), as the data controller, hereby provides you with a brief summary of the data processing activities it carries out.
The Data Controller would like to draw the attention of the data subjects to the fact that
- data subjects may exercise their rights (the right of access, the right to rectification, the right to erasure and the right to be “forgotten,” the right to restrict processing, the right to object, and the right to data portability) by sending a statement to the email addresses info@tubatanya.hu, info@villacuvee.hu, info@hoteldelibab.hu, info@mirage-etterem.hu, or by sending a statement to any other contact information provided by the Data Controller; furthermore, in the event of a violation of their rights, they may file a complaint with the authority (for current contact information, see: NAIH, www.naih.hu) or to the court with jurisdiction over their place of residence and may claim compensation for damages. The Data Controller draws the attention of data subjects to the fact that the exercise of their rights may be subject to conditions and limitations in connection with specific data processing activities, which the Data Controller is obligated to examine when data subjects exercise their rights. In the event that a data subject cannot exercise a right in connection with a specific data processing activity, the Data Controller shall inform the data subject in writing (including by electronic means) of the factual and/or legal grounds precluding or limiting the exercise of that right and shall maintain a record thereof.
- more detailed explanations of each data processing activity can be found in Appendix I of the Internal Data Protection Policy.
- profiling does not take place in connection with any of the data processing activities.
- data may be disclosed to third parties in connection with a specific data processing activity, as set forth in the detailed information notice for that activity; and if data is disclosed in connection with any of the data processing activities specified below, the recipient of the disclosure (data controller or data processor) is identified in Annex II.
- a separate cookie policy has been established.
- the following summary covers all data processing activities carried out by the Data Controller, except for those that apply exclusively to the Data Controller’s employees.
Summary Table of Data Processing for One-Time Requests for and Provision of Information |
||||||
| Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| providing the data subject with appropriate information and maintaining contact accordingly | voluntary consent, compliance with a legal obligation, a contractual basis, a legitimate interest, or a vital interest | Any natural person, including a representative acting on behalf of an organization, who comes into contact with the Data Controller and requests or receives information from the Data Controller | Further details can be found in the data processing notice/description | until the purpose is fulfilled, or until a request for erasure is made, or
within the time limit specified by law, or until the statute of limitations expires, or until the legitimate interest ceases to exist |
electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processed in the Course of Ongoing, Regular Communication with Data Subjects |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| maintaining contact with the affected party; responding to and resolving any questions, requests, and other matters that arise | voluntary consent, compliance with a legal obligation, a contractual basis, a legitimate interest, a legal obligation, or a vital interest | Any natural person—including a natural person acting on behalf of or in representation of an organization—who, beyond a one-time request for information, maintains ongoing or regular contact with the Data Controller | Further details can be found in the data processing notice/description | until the purpose is fulfilled, or until a request for erasure is made, or
within the time limit specified by law, or until the statute of limitations expires, or until the legitimate interest ceases to exist |
electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing Related to the Request for Proposals Issued by the Data Subject and the Proposal Submitted by the Data Controller |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| providing the data subject with an appropriate offer and maintaining contact | voluntary consent, or Article 6(1)(b) of the GDPR | Any natural person—including a natural person acting on behalf of or in representation of an organization—who requests an offer from the Data Controller and provides their personal data | Further details can be found in the data processing notice/description | during the period of validity, or, if consent is given, until the legal relationship expires, or, in the case of data processing based on a legitimate interest, until such interest ceases to exist | electronically and/or on paper, typically electronically, and is done manually | Data Subjects |
Data processing related to calls for proposals issued by the data controller and the submission of proposals in response thereto |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Submitting a proposal in response to a call for proposals from the Data Controller and maintaining contact | Voluntary consent, the data controller’s legitimate interest, or compliance with a legal obligation | Further details can be found in the data processing notice/description | Further details can be found in the data processing notice/description | If accepted, 8 years; if not accepted, for the duration of validity or by the deadline specified in the relevant legislation or call for proposals | Electronically, on paper, manually | Data Subjects |
Summary Table of Data Processing Related to the Conclusion of an Agreement |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| concluding the agreement, fulfilling it, monitoring its fulfillment, and maintaining contact | Conclusion of an Agreement (GDPR Article 6(1)(b))
The processing of representatives' and contact persons' data is based on legitimate interests |
Any natural person, as well as any natural person acting on behalf of or representing an organization, who enters into an agreement with the Data Controller in their own name—provided they have provided their personal data—or who is listed in the contract as a representative or contact person | Further details can be found in the data processing notice/description | statute of limitations or
the term specified in the agreement, or cannot be discarded, so it cannot be deleted |
electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing for Appointment Scheduling (Booking Appointments) |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| scheduling appointments for the data subject and maintaining contact | based on voluntary consent | Any natural person—including a natural person acting on behalf of or in representation of an organization—who books or schedules an appointment by providing their information | Further details can be found in the data processing notice/description | until the purpose is fulfilled, or until the general statute of limitations expires, or until the legitimate interest ceases to exist | electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing Related to Consent Statements |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| the ability to demonstrate the legal basis for data processing, as well as the fulfillment of consent and maintaining contact. | voluntary consent | Any natural person who provides the Data Controller with a statement consenting to the processing of their data for any purpose | Further details can be found in the data processing notice | until consent is withdrawn or the data is deleted
Consent statements will be deleted after the statute of limitations following the withdrawal has expired |
electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing Activities Involving the Creation of Photographs, Video Recordings, and Audio Recordings of the Data Subject with the Data Subject’s Consent |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| az érintett hozzájárásulásában meghatározott cél | voluntary consent | any natural person who gives prior consent to having photographs, videos, and/or audio recordings made of them | Further details can be found in the data processing notice | until deleted at the request of the data subject | electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing Related to the Handling of Claims and Complaints |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Identifying the affected party and the complaint, as well as handling the complaint and maintaining communication | It is based on voluntary consent, but pursuant to Article 6(1)(c) of the GDPR, the processing is necessary for compliance with a legal obligation to which the data controller is subject, in accordance with Section 17/A(7) of Act CLV of 1997 on Consumer Protection. | Any natural person who submits a complaint regarding a service received, a product purchased, and/or the Data Controller’s conduct, actions, or omissions | Further details can be found in the data processing notice/description | The data controller retains the record of the complaint and a copy of the response for 5 years from the date of their creation, in accordance with the Consumer Protection Act. | electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing Related to the Registry of Data Subjects (Customers and Partners) |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| identifying the data subject, maintaining contact with them, and monitoring the fulfillment of the agreement (if applicable) | based on voluntary consent, or on an agreement, or is necessary for the performance of a legal obligation, or based on a legitimate interest | Any natural person, as well as the representative of a non-natural person, who is a Partner/customer of the Data Controller, or who wishes to become a Partner/customer, or who is an Employee | Further details can be found in the data processing notice/description | until deleted at the request of the data subject,
deletion due to unsuccessful data reconciliation, until deletion due to the death of the person concerned, or if it is for the Data Controller's interest, until such interest ceases to exist. The data controller may designate the record as having permanent value; therefore, the data contained therein may not be deleted. |
electronically (on paper), manually | Data subjects, or possibly a partner |
Summary Table of Data Processing Related to the Registration of Data Subjects (Regular Customers) |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| az érintettek azonosítása, jogosultságainak megadása és ellenőrzése, kedvezmények nyújtása, az érintettek tájékoztatása a kizárólag törzsvásárlóknak/törzsvendégeknek szóló kedvezményekről, akciókról, egyebekről, kapcsolattartás | önkéntes hozzájáruláson alapul, vagy megállapodáson alapul vagy jogos érdeken alapul (ha az érintett kapcsolattartó/képviselő az Adatkezelővel kötött megállapodásban) | Minden természetes személy, ideértve szervezet nevében eljáró természetes személyt (képviselő, kapcsolattartó) is, aki teljesítette a törzsvendéggé válás feltételeit és bekerült az e célt szolgáló nyilvántartásba | Further details can be found in the data processing notice/description | a törzsvendég szabályzatban meghatározott határidőben, vagy
until deleted at the request of the data subject, deletion due to unsuccessful data reconciliation, until deletion due to the death of the person concerned, ha Adatkezelő érdeke megkívánja, akkor az érdek megszűnéséig tart. Adatkezelő a nyilvántartást maradandó értékűnek nyilváníthatja, ezért a benne szereplő adatokat nem lehet törölni. |
electronically (on paper), manually | Data Subjects |
Summary Table of Data Processing Related to Landline Phone Calls |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| quality improvement, monitoring of customer relations, and the documentation and more effective resolution of stakeholder and user needs and issues | voluntary consent | Any natural person—including a natural person acting on behalf of or in representation of an organization—who wishes to contact the Data Controller or maintain contact with the Data Controller through the landline customer service line | Further details can be found in the data processing notice/description | For 6 months; in the event of a complaint, for 5 years pursuant to Act CLV of 1997 | electronically, automatically | Data Subjects |
Summary Table of Data Disclosure (to Third Parties) |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Unique purpose | consent, compliance with a legal obligation, agreement, legitimate interest | Any natural person, including a natural person acting on behalf of or in representation of an organization, whose data is disclosed by the Data Controller to a third party | Further details can be found in the data processing notice/description | Until the purpose is fulfilled, or until the statute of limitations expires, or until the deadline specified by law, or until the legitimate interest ceases to exist | This is done electronically and/or on paper, manually, in compliance with data security requirements and the principle of confidentiality | Data subjects, data processors, official registry |
Summary Table of Data Processing Related to Room Reservations |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| processing the accommodation reservation request, booking the accommodation by linking it to the data subject, and maintaining contact with the data subject | voluntary consent | Any natural person who books a room at an accommodation facility operated by the Data Controller by providing their personal data | Further details can be found in the data processing notice | In the event of a no-show, the reservation is canceled immediately; otherwise, it expires after the applicable period. | electronically, on paper, manually | data subjects, or possibly a Partner (travel agency/tour operator) |
Summary Table of Data Processing Related to Check-In and the Check-In Form/Guest and Tourism Registry |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| to ensure full compliance with the law; to establish the accommodation service contract and provide evidence of its conclusion and fulfillment; and to handle any claims and maintain contact with the data subject | compliance with a legal obligation, legitimate interest, voluntary consent, entering a contract | Any natural person who checks in at an accommodation facility operated by the Data Controller by providing their personal data and filling out a registration form or guest register | see the registration form/guest register | Further details can be found in the data processing notice | electronically, on paper, manually | data subjects, or possibly a Partner (travel agency/tour operator) |
Accommodation Reservations Made by the Data Controller on Behalf of a Third Party |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Ordering a taxi for the data subject to a specified location and time, and maintaining contact with the data subject | Voluntary consent | Any natural person for whom the Data Controller orders a taxi | Further details can be found in the data processing notice | Further details can be found in the data processing notice | Electronically, manually | Data subject, or possibly a partner |
Summary Table of Data Processing Related to Table Reservations |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| reserving a table, identifying the data subjects, and maintaining contact | based on voluntary consent | Any individual who wished to reserve a table by providing their information | Further details can be found in the data processing notice/description | until the purpose is fulfilled | electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing Related to Camp Activities |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Identifying data subjects, determining their eligibility to use the service in question, entering into an agreement, providing and fulfilling the service, and, if necessary, maintaining contact | Voluntary consent or the signing of an agreement (GDPR Article 6(1)(b))
Legitimate interest in the processing of representative/contact person data |
Any natural person whose data is provided to the Data Controller by the data subject in connection with requesting services related to camps organized by the Data Controller or entering into a contract. Data subjects include, in particular, children and their legal representatives. | Further details can be found in the data processing notice/description | until the purpose is achieved or for 5 years | electronically, on paper, manually | Data Subjects |
Summary Table of Data Processing Related to Health Status |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Providing appropriate services to the individual concerned and maintaining contact | voluntary consent | Any natural person who shares health data with the Data Controller | Further details can be found in the data processing notice | primarily until the objective is achieved, or
until revoked, but no longer than the statute of limitations |
electronically, on paper, manually | Data Subjects |
Summary Table of Data Processing Related to Bank Information and Bank Transfers |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Facilitating and Monitoring Financial Transaction Completion | compliance with a legal obligation and/or an agreement, or voluntary consent | Any natural person to whom a bank transfer initiated by the Data Controller is made, as well as any natural person who wishes to make a financial payment to the Data Controller via a bank transfer | Further details can be found in the data processing notice/description | Until the statute of limitations expires or by the deadline specified by law | Done electronically, manually, or automatically | from our own records, from the data subjects |
Summary Table of Data Processing Related to Invoicing |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| compliance with a legal obligation | Compliance with legal obligations under Act CXXVII of 2007 on Value-Added Tax and the regulations issued pursuant to that Act | any natural person, including sole proprietors, whose information appears on an invoice (or an accounting document deemed equivalent) issued by the Data Controller (even if it appears in a “remarks,” “notes,” or similar field) | The categories of data set forth in Sections 169–170 and Section 176 of Act CXXXVII of 2007 | 8 years | on paper/electronically, manually | data subjects; rarely official records |
Summary Table of Data Processing Related to Invoice Receipt |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| full compliance with legal obligations; retention of invoices (and documents deemed equivalent thereto) pursuant to Section 179 of Act CXXVII of 2007 | jogi kötelezettség teljesítése (2007. évi CXXVII. tv. 179. §) | minden természetes személy, akinek adata az Adatkezelő által befogadott számlára (vagy azzal egy tekintet alá eső számviteli bizonylatra) vagy mellékletére rákerült | The categories of data set forth in Sections 169–170 and Section 176 of Act CXXXVII of 2007 | 8 years | on paper/electronically, manually | invoicing party |
Summary Table of Camera System Operations |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Purposes specified in the camera policy, such as property protection, protection of personal safety and physical well-being, etc., and identification of data subjects | the Data Controller's legitimate interest | Any natural person who enters or remains in an area monitored by a surveillance camera system | Further details can be found in the data processing notice/description | 8 days from the date of recording | electronically, automatically | Data Subjects |
Summary Table of Data Processing Related to the Operation of an Electronic Access Card System |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Identifying data subjects, granting and verifying their access rights, and ensuring personal and property protection and security | the Data Controller's legitimate interest | Any natural person to whom the Data Controller issues a device (e.g., a card) that grants access | Further details can be found in the data processing notice/description | Records must be deleted 180 days after the right to regular entry expires; in the case of occasional entry (when a guest card is issued), records must be deleted 1 day after departure | electronically, automatically | Data Subjects |
Summary Table of Data Processing Related to the Sending of Newsletters |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Providing the recipient with comprehensive, general, or personalized and regular information about the Data Controller’s latest promotions, events, and news | based on voluntary consent | Any natural person who wishes to receive regular updates about the Data Controller’s news, promotions, and discounts and who, for this purpose, subscribes to the newsletter service by providing their personal data | Further details can be found in the data processing notice/description | Until cancellation | Sign-up electronically or on paper, manually
sending electronically, automatically cancellation can be done electronically or on paper, manually. |
Data Subjects |
Summary Table of Data Processing Related to the Organization of a Prize Contest |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| enabling participation, identifying participants during the drawing, and maintaining contact | voluntary consent | any natural person who wishes to participate in a sweepstakes organized by the data controller by providing their personal data | Further details can be found in the data processing notice | until the objective is achieved or the statute of limitations expires | application submitted electronically, on paper, or manually
The prize draw can be conducted automatically or manually (depending on the type of draw) |
Data Subjects |
Fundus Invest Kft. Sweepstakes Rules
The sweepstakes conducted in accordance with these rules is organized by Fundus Invest Kft. (registered office: 4200 Hajdúszoboszló, József Attila u. 5-7., company registration number: 09-09-019876, tax ID: 22990136-2-09, phone number: 52/360-366, email: info@hoteldelibab.hu, represented by Éva Czene, managing director, hereinafter referred to as the “Organizer”) independently organizes the sweepstakes in accordance with these rules:
- The Organizer is the data processor and data controller for the sweepstakes. During the duration of the sweepstakes, the rules will be available to all users on the https://hoteldelibab.hu/ website. The Organizer will post any amendments to the rules, as well as any notice regarding the termination of the sweepstakes, on this website.
- Any decision made by the Organizer of the sweepstakes regarding this contest is final and binding in all respects; no legal action may be brought in connection with such decisions. The Organizer excludes the possibility of any user of the website or participant in the contest asserting any claim against the Organizer on any grounds whatsoever.
- The organizer reserves the right to cancel or suspend the game, or to withhold prizes in whole or in part, if there is suspicion of abuse or a violation of the terms and conditions in connection with the game, or in the event of force majeure.
- The Organizer reserves the right to supplement or modify the rules of the game or the game itself, but is required to notify website users and game participants of such changes via the website.
- Participation in the promotional game constitutes an understanding and acceptance of the rules in effect at any given time.
I. Defining the game
- 1 Gift Certificate (see: the “Prizes” section) will be awarded to the person who uploads a photo to the “TAKE A PHOTO AND WIN” post published by the Organizer of the promotional contest on the Hotel Délibáb Facebook page (https://www.facebook.com/HotelDelibabHajduszoboszlo) and whose uploaded photo receives the most “likes.”
- Based on the above, the Organizer is entitled to verify the number of “likes” received on the photos.
- The duration of the game:
The first round of the contest, which involves uploading photos, runs from December 21, 2020, until 12:00 a.m. on December 27, 2020. The second round of the contest runs from December 28, 2020, through January 4, 2021, during which time participants can collect “likes” on the photos they’ve uploaded and organized into an album. The winner of the contest will be the person who uploaded the photo with the most “likes.” The Organizer will notify the Winner via a public Facebook post no later than January 10, 2021, and will ask the Winner to contact the Organizer to arrange delivery of the prize.
II. Conditions of participating in the game:
- Any natural person who meets the requirements set forth in Section I may participate in the sweepstakes, with the following exceptions:
a. the Organizer’s senior officers, employees, agents, and the close relatives of such persons as defined in the Civil Code currently in force; and
b. senior officers, employees, and agents of the individuals and companies involved in the preparation and conduct of the sweepstakes on behalf of the Organizer, as well as the close relatives of such individuals as defined in the Civil Code currently in force.
IV. How the game works
- The organizer asks participants to upload their photos to the contest via the Hotel Délibáb Facebook page (https://www.facebook.com/HotelDelibabHajduszoboszlo) by December 27, 2020, in response to the post published on December 21, 2020.
- The Organizer will create a photo album from the photos uploaded by December 27, 2020, and publish it in a post. The photos collected in the album can receive “Likes” between December 28, 2020, and January 4, 2021.
- The person who uploaded the photo with the most likes by January 4, 2021, will win the prize specified in Section V of these contest rules.
- The winner may claim the prize only by responding to the confirmation email/electronic message/other communication received from the Organizer: the winner must confirm their participation in the contest and acceptance of the prize within 5 days of receiving the email notification/electronic message/other communication.
- If
a. the deadline has passed without a result, or
b. the provided email address is incorrect, does not exist, or we were unable to contact the recipient after three attempts, or
c. the winner informs the Organizer that they did not participate in the contest, or
d. If the winner does not wish to accept the prize, the alternate winner will be notified. In this case, the person who uploaded the photo with the next highest number of “Likes” will be announced as the alternate winner, as described above.
6. If
a. the deadline regarding the substitute winner has passed without a result, or
b. the provided email address is incorrect, does not exist, or we were unable to contact the recipient after three attempts, or
c. the substitute winner informs the Organizer that they did not participate in the contest, or
d. If the winner does not wish to accept the prize, the Organizer will hold a drawing to award the prize among those who uploaded a photo by the deadline described above.
7. The winner will receive the prize electronically via email, electronic message, or another agreed-upon method of contact.
V. The prize
- The prize for the promotional contest:
1 Gift Certificate with the following details and validity period:
✅Accommodation for 1 night for 2 people in a Classic Room with a balcony
✅Use of the room and wellness facilities until 3:00 p.m. on the day of departure
✅ Buffet breakfast and dinner as part of the half-board plan
✅Unlimited access to the Délibáb Wellness Oasis & Thermal Spa during business hours:
✅Indoor adventure pool (30–32°C) with a hot tub and a lazy river
✅ Separate thermal pools with medicinal water at temperatures of 32–34°C and 36–38°C ✅ Sauna area: bio and Finnish saunas, plunge pool, ice fountain, and tropical shower
✅ Steam room and relaxation room with salt bricks
✅ baby paddling pool (20 cm deep, approx. 32 °C)
✅1 afternoon coffee or tea and a pastry
✅Use of the indoor play area: double wave slide with a ball pit, donut swing, logic games
✅Gym with cardio machines
✅ Bathrobe and slippers for the duration of the stay
✅ Free Wi-Fi in the rooms and common areas
✅ Parking - The gift certificate is valid from January 10, 2021, through December 23, 2021 (excluding peak periods and holidays)
- The prize cannot be exchanged for another product or redeemed for cash.
VI. Data Protection
- With regard to data protection, the Organizer has adopted a Data Protection and Data Security Policy.
- The rules governing data management and data processing related to the sweepstakes are set forth in the current Data Protection and Data Security Policy.
- The current Privacy and Data Security Policy is available on the https://hoteldelibab.hu/ website.
- In these Rules, the Organizer also draws participants’ attention to the fact that the legal basis for the processing of their data is the voluntary participation of the participants, as data subjects in the contest, through their voluntary participation, their review of these contest rules and the Privacy and Data Security Policy, and their acceptance thereof through participation; the purpose of such processing is to identify the winner and to maintain contact.
- The organizer may make the winner’s name available to third parties on the Hotel Délibáb Facebook page; therefore, it urges users of the Hotel Délibáb Facebook page to consider this fact when deciding whether to participate in the promotional contest.
- Given that participation in the game is free (not tied to placing bets), and that participation is contingent upon liking and sharing photos posted on a social media site, this activity does not fall under the scope of Act XXXIV of 1991 on the Organization of Gambling, is not subject to a license, and is not subject to a reporting requirement. Should the Organizer incur any tax liability arising from the organization of this prize contest, it shall not pass such liability on to the participants or the winners but shall bear it itself.
Summary Table related to Event Planning |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| carrying out tasks related to organizing the event and maintaining contact with the data subjects | based on voluntary consent, an agreement, or a legitimate interest | Any individual who attends an event or uses event planning services | Further details can be found in the data processing notice/description | statute of limitations | electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing Related to Gift Certificates (Coupons) |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Enabling the purchase of gift certificates/coupons and their redemption when purchasing the Data Controller’s services/products; maintaining contact | voluntary consent, legitimate interest, agreement | Any natural person who wishes to purchase or redeem a gift certificate or coupon in connection with one of the Data Controller’s services or products | Further details can be found in the data processing notice/description | validity period
if exchanged, the statute of limitations 5 years for receipts |
electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing Related to Customer Satisfaction Surveys |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| to improve the quality of services, products, and the Data Controller’s conduct; to investigate any complaints; and to maintain contact | the Data Controller's legitimate interest | Any natural person who participates in a customer satisfaction survey as part of the Data Controller’s quality assurance process | Further details can be found in the data processing notice/description | Until the objective is achieved, or for 5 years in the event of a complaint | electronically and/or on paper, done manually | internal record of data subjects |
Summary Table of Data Processing Related to Social Media Marketing |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| The Data Controller's marketing activity | Voluntary consent | Natural persons who voluntarily follow, share, or like the Data Controller’s social media page or the content posted on it | Further details can be found in the data processing notice/description | Until deletion at the request of the data subject or until the legitimate interest ceases to exist | Done electronically, manually | Data Subjects |
Summary Table of Data Processing Related to the Guestbook |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| to allow the data subject to express their opinion regarding the Data Controller’s services in order to improve the quality of those services and to inform others, as well as to enable the Data Controller to contact the data subject regarding any complaints | voluntary consent, in the event of a complaint | Any natural person who wishes to share their opinion with the Data Controller and others through the guestbook | Further details can be found in the data processing notice | Until deleted at the request of the data subject; in the event of a complaint, for 5 years (pursuant to Act CLV of 1997) | electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing Related to the Handling of Job Applicants' Data |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Application and Selection Process, and Communication | Voluntary consent | Any natural person who applies for a job opening advertised by the Data Controller, or who applies without a specific job opening being advertised | Further details can be found in the data processing notice/description | for the period specified in the written consent or until the legitimate interest ceases to exist | Electronically and/or on paper, done manually | Data Subjects |
Summary Table of Data Processing Related to Aptitude Tests |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
|
Assessment of the professional qualifications (competencies) necessary to exercise the rights and fulfill the obligations specified in the rules governing the legal relationship |
voluntary consent or legitimate interest |
Any natural person who participates in a competency test |
Further details can be found in the data processing notice/description |
Until a request for deletion is made, or until the period specified in the consent, or until the statute of limitations expires |
electronically and/or on paper, done manually |
Data Subjects |
Summary Table of Data Processing Related to Language Proficiency Assessment Tests |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Identifying the specific language level of the applicant to ensure the most effective language learning | voluntary consent | Any natural person who takes the language proficiency assessment test | Further details can be found in the data processing notice | ntil the purpose is fulfilled, or until the data subject requests erasure, or—if the data subject is assigned to a specific group—on the basis of a legitimate interest (for the purposes of subsequent comparison and to reinforce language development)—the duration of data processing corresponds to the duration of the language training; subject to the statute of limitations | electronically, on paper, manually | Data Subjects |
Fundus Invest Kft. record of data processors and recipients of data transfers
Fundus Invest Kft. (Headquarters: 4200 Hajdúszoboszló, József Attila St. 5-7, Company Registration No.: 09-09-019876, Tax ID: 22990136-2-09, phone numbers: Tuba Tanya: 21/350-0444, 30/300-2988; Villa Cuvée: 21/350-0222, Hotel Délibáb: 21/350-0777, 52/360-366; Mirage Restaurant: 52/898-151, email: info@tubatanya.hu, info@villacuvee.hu, info@hoteldelibab.hu, info@mirage-etterem.hu, represented independently by Éva Czene, Managing Director), as the data controller, hereby informs data subjects of the following:
The Data Controller’s data processor, which has been entrusted with performing outsourced auditing tasks:
Name: AUDIT TEAM 2000 KFT. | Judit Pétisné Mészáros
Székhely: 4026 Debrecen, Péterfia utca 46. Fszt. 1.
Elérhetőségi adatok: +36 52 410 038
Adatkezelő tárhelyszolgáltatás feladatával megbízott adatfeldolgozója:
Név: MADE BY NARO BT.
Székhely: 4225 Debrecen, Kiserdő u. 11.
Elérhetőségi adatok: +36 30 326 6590 | info@naro.hu
Adatkezelő call center szolgáltatás hangrögzítéssel feladatával megbízott adatfeldolgozója:
Név: ARENIM TECHNOLOGIES KFT.
Székhely: 1117 Budapest, Infópark sétány1.
Elérhetőségi adatok: +36 1 855 5666 | support@arenimtel.com
Subscribe to Newsletter
Data Protection
Appendix III/c to the Internal Data Protection Policy:
Fundus Invest Kft.
External Privacy Policy
(as seen on the www.villacuvee.hu website)
Fundus Invest Kft. (registered office: 4200 Hajdúszoboszló, József Attila u. 5-7, company registration number: 09-09-019876, tax ID number: 22990136-2-09, phone number: Tuba Farm: 21/350-0444, 30/300-2988; Villa Cuvée: 21/350-0222, Hotel Délibáb: 21/350-0777, 52/360-366; Mirage Restaurant: 52/898-151, e-mail: info@tubatanya.hu, info@villacuvee.hu, info@hoteldelibab.hu, info@mirage-etterem.hu, represented independently by Éva Czene, Managing Director), as the data controller, hereby provides you with a brief summary of the data processing activities it carries out.
The Data Controller would like to draw the attention of the data subjects to the fact that
- data subjects may exercise their rights (the right of access, the right to rectification, the right to erasure and the right to be “forgotten,” the right to restrict processing, the right to object, and the right to data portability) by sending a statement to the email addresses info@tubatanya.hu, info@villacuvee.hu, info@hoteldelibab.hu, info@mirage-etterem.hu, or by sending a statement to any other contact information provided by the Data Controller; furthermore, in the event of a violation of their rights, they may file a complaint with the authority (for current contact information, see: NAIH, www.naih.hu) or to the court with jurisdiction over their place of residence and may claim compensation for damages. The Data Controller draws the attention of data subjects to the fact that the exercise of their rights may be subject to conditions and limitations in connection with specific data processing activities, which the Data Controller is obligated to examine when data subjects exercise their rights. In the event that a data subject cannot exercise a right in connection with a specific data processing activity, the Data Controller shall inform the data subject in writing (including by electronic means) of the factual and/or legal grounds precluding or limiting the exercise of that right and shall maintain a record thereof.
- more detailed explanations of each data processing activity can be found in Appendix I of the Internal Data Protection Policy.
- profiling does not take place in connection with any of the data processing activities.
- data may be disclosed to third parties in connection with a specific data processing activity, as set forth in the detailed information notice for that activity; and if data is disclosed in connection with any of the data processing activities specified below, the recipient of the disclosure (data controller or data processor) is identified in Annex II.
- a separate cookie policy has been established.
- the following summary covers all data processing activities carried out by the Data Controller, except for those that apply exclusively to the Data Controller’s employees.
|
Summary Table of Data Processing for One-Time Requests for and Provision of Information |
||||||
| Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| providing the data subject with appropriate information and maintaining contact accordingly | voluntary consent, compliance with a legal obligation, a contractual basis, a legitimate interest, or a vital interest | Any natural person, including a representative acting on behalf of an organization, who comes into contact with the Data Controller and requests or receives information from the Data Controller | Further details can be found in the data processing notice/description | until the purpose is fulfilled, or until a request for erasure is made, or
within the time limit specified by law, or until the statute of limitations expires, or until the legitimate interest ceases to exist |
electronically and/or on paper, done manually | Data Subjects |
|
Summary Table of Data Processed in the Course of Ongoing, Regular Communication with Data Subjects |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| maintaining contact with the affected party; responding to and resolving any questions, requests, and other matters that arise | voluntary consent, compliance with a legal obligation, a contractual basis, a legitimate interest, a legal obligation, or a vital interest | Any natural person—including a natural person acting on behalf of or in representation of an organization—who, beyond a one-time request for information, maintains ongoing or regular contact with the Data Controller | Further details can be found in the data processing notice/description | until the purpose is fulfilled, or until a request for erasure is made, or
within the time limit specified by law, or until the statute of limitations expires, or until the legitimate interest ceases to exist |
electronically and/or on paper, done manually | Data Subjects |
|
Summary Table of Data Processing Related to the Request for Proposals Issued by the Data Subject and the Proposal Submitted by the Data Controller |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| providing the data subject with an appropriate offer and maintaining contact | voluntary consent, or Article 6(1)(b) of the GDPR | Any natural person—including a natural person acting on behalf of or in representation of an organization—who requests an offer from the Data Controller and provides their personal data | Further details can be found in the data processing notice/description | during the period of validity, or, if consent is given, until the legal relationship expires, or, in the case of data processing based on a legitimate interest, until such interest ceases to exist | electronically and/or on paper, typically electronically, and is done manually | Data Subjects |
|
Data processing related to calls for proposals issued by the data controller and the submission of proposals in response thereto |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Submitting a proposal in response to a call for proposals from the Data Controller and maintaining contact | Voluntary consent, the data controller’s legitimate interest, or compliance with a legal obligation | Further details can be found in the data processing notice/description | Further details can be found in the data processing notice/description | If accepted, 8 years; if not accepted, for the duration of validity or by the deadline specified in the relevant legislation or call for proposals | Electronically, on paper, manually | Data Subjects |
|
Summary Table of Data Processing Related to the Conclusion of an Agreement |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| concluding the agreement, fulfilling it, monitoring its fulfillment, and maintaining contact | Conclusion of an Agreement (GDPR Article 6(1)(b))
The processing of representatives' and contact persons' data is based on legitimate interests |
Any natural person, as well as any natural person acting on behalf of or representing an organization, who enters into an agreement with the Data Controller in their own name—provided they have provided their personal data—or who is listed in the contract as a representative or contact person | Further details can be found in the data processing notice/description | statute of limitations or
the term specified in the agreement, or cannot be discarded, so it cannot be deleted |
electronically and/or on paper, done manually | Data Subjects |
|
Summary Table of Data Processing for Appointment Scheduling (Booking Appointments) |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| scheduling appointments for the data subject and maintaining contact | based on voluntary consent | Any natural person—including a natural person acting on behalf of or in representation of an organization—who books or schedules an appointment by providing their information | Further details can be found in the data processing notice/description | until the purpose is fulfilled, or until the general statute of limitations expires, or until the legitimate interest ceases to exist | electronically and/or on paper, done manually | Data Subjects |
|
Summary Table of Data Processing Related to Consent Statements |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| the ability to demonstrate the legal basis for data processing, as well as the fulfillment of consent and maintaining contact. | voluntary consent | Any natural person who provides the Data Controller with a statement consenting to the processing of their data for any purpose | Further details can be found in the data processing notice | until consent is withdrawn or the data is deleted
Consent statements will be deleted after the statute of limitations following the withdrawal has expired |
electronically and/or on paper, done manually | Data Subjects |
|
Summary Table of Data Processing Activities Involving the Creation of Photographs, Video Recordings, and Audio Recordings of the Data Subject with the Data Subject’s Consent |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| az érintett hozzájárásulásában meghatározott cél | voluntary consent | any natural person who gives prior consent to having photographs, videos, and/or audio recordings made of them | Further details can be found in the data processing notice | until deleted at the request of the data subject | electronically and/or on paper, done manually | Data Subjects |
|
Summary Table of Data Processing Related to the Handling of Claims and Complaints |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Identifying the affected party and the complaint, as well as handling the complaint and maintaining communication | It is based on voluntary consent, but pursuant to Article 6(1)(c) of the GDPR, the processing is necessary for compliance with a legal obligation to which the data controller is subject, in accordance with Section 17/A(7) of Act CLV of 1997 on Consumer Protection. | Any natural person who submits a complaint regarding a service received, a product purchased, and/or the Data Controller’s conduct, actions, or omissions | Further details can be found in the data processing notice/description | The data controller retains the record of the complaint and a copy of the response for 5 years from the date of their creation, in accordance with the Consumer Protection Act. | electronically and/or on paper, done manually | Data Subjects |
|
Summary Table of Data Processing Related to the Registry of Data Subjects (Customers and Partners) |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| identifying the data subject, maintaining contact with them, and monitoring the fulfillment of the agreement (if applicable) | based on voluntary consent, or on an agreement, or is necessary for the performance of a legal obligation, or based on a legitimate interest | Any natural person, as well as the representative of a non-natural person, who is a Partner/customer of the Data Controller, or who wishes to become a Partner/customer, or who is an Employee | Further details can be found in the data processing notice/description | until deleted at the request of the data subject,
deletion due to unsuccessful data reconciliation, until deletion due to the death of the person concerned, or if it is for the Data Controller's interest, until such interest ceases to exist. The data controller may designate the record as having permanent value; therefore, the data contained therein may not be deleted. |
electronically (on paper), manually | Data subjects, or possibly a partner |
|
Summary Table of Data Processing Related to the Registration of Data Subjects (Regular Customers) |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| az érintettek azonosítása, jogosultságainak megadása és ellenőrzése, kedvezmények nyújtása, az érintettek tájékoztatása a kizárólag törzsvásárlóknak/törzsvendégeknek szóló kedvezményekről, akciókról, egyebekről, kapcsolattartás | önkéntes hozzájáruláson alapul, vagy megállapodáson alapul vagy jogos érdeken alapul (ha az érintett kapcsolattartó/képviselő az Adatkezelővel kötött megállapodásban) | Minden természetes személy, ideértve szervezet nevében eljáró természetes személyt (képviselő, kapcsolattartó) is, aki teljesítette a törzsvendéggé válás feltételeit és bekerült az e célt szolgáló nyilvántartásba | Further details can be found in the data processing notice/description | a törzsvendég szabályzatban meghatározott határidőben, vagy
until deleted at the request of the data subject, deletion due to unsuccessful data reconciliation, until deletion due to the death of the person concerned, ha Adatkezelő érdeke megkívánja, akkor az érdek megszűnéséig tart. Adatkezelő a nyilvántartást maradandó értékűnek nyilváníthatja, ezért a benne szereplő adatokat nem lehet törölni. |
electronically (on paper), manually | Data Subjects |
|
Summary Table of Data Processing Related to Landline Phone Calls |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| quality improvement, monitoring of customer relations, and the documentation and more effective resolution of stakeholder and user needs and issues | voluntary consent | Any natural person—including a natural person acting on behalf of or in representation of an organization—who wishes to contact the Data Controller or maintain contact with the Data Controller through the landline customer service line | Further details can be found in the data processing notice/description | For 6 months; in the event of a complaint, for 5 years pursuant to Act CLV of 1997 | electronically, automatically | Data Subjects |
|
Summary Table of Data Disclosure (to Third Parties) |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Unique purpose | consent, compliance with a legal obligation, agreement, legitimate interest | Any natural person, including a natural person acting on behalf of or in representation of an organization, whose data is disclosed by the Data Controller to a third party | Further details can be found in the data processing notice/description | Until the purpose is fulfilled, or until the statute of limitations expires, or until the deadline specified by law, or until the legitimate interest ceases to exist | This is done electronically and/or on paper, manually, in compliance with data security requirements and the principle of confidentiality | Data subjects, data processors, official registry |
|
Summary Table of Data Processing Related to Room Reservations |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| processing the accommodation reservation request, booking the accommodation by linking it to the data subject, and maintaining contact with the data subject | voluntary consent | Any natural person who books a room at an accommodation facility operated by the Data Controller by providing their personal data | Further details can be found in the data processing notice | In the event of a no-show, the reservation is canceled immediately; otherwise, it expires after the applicable period. | electronically, on paper, manually | data subjects, or possibly a Partner (travel agency/tour operator) |
|
Summary Table of Data Processing Related to Check-In and the Check-In Form/Guest and Tourism Registry |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| to ensure full compliance with the law; to establish the accommodation service contract and provide evidence of its conclusion and fulfillment; and to handle any claims and maintain contact with the data subject | compliance with a legal obligation, legitimate interest, voluntary consent, entering a contract | Any natural person who checks in at an accommodation facility operated by the Data Controller by providing their personal data and filling out a registration form or guest register | see the registration form/guest register | Further details can be found in the data processing notice | electronically, on paper, manually | data subjects, or possibly a Partner (travel agency/tour operator) |
|
Accommodation Reservations Made by the Data Controller on Behalf of a Third Party |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Ordering a taxi for the data subject to a specified location and time, and maintaining contact with the data subject | Voluntary consent | Any natural person for whom the Data Controller orders a taxi | Further details can be found in the data processing notice | Further details can be found in the data processing notice | Electronically, manually | Data subject, or possibly a partner |
|
Summary Table of Data Processing Related to Table Reservations |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| reserving a table, identifying the data subjects, and maintaining contact | based on voluntary consent | Any individual who wished to reserve a table by providing their information | Further details can be found in the data processing notice/description | until the purpose is fulfilled | electronically and/or on paper, done manually | Data Subjects |
|
Summary Table of Data Processing Related to Camp Activities |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Identifying data subjects, determining their eligibility to use the service in question, entering into an agreement, providing and fulfilling the service, and, if necessary, maintaining contact | Voluntary consent or the signing of an agreement (GDPR Article 6(1)(b))
Legitimate interest in the processing of representative/contact person data |
Any natural person whose data is provided to the Data Controller by the data subject in connection with requesting services related to camps organized by the Data Controller or entering into a contract. Data subjects include, in particular, children and their legal representatives. | Further details can be found in the data processing notice/description | until the purpose is achieved or for 5 years | electronically, on paper, manually | Data Subjects |
|
Summary Table of Data Processing Related to Health Status |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Providing appropriate services to the individual concerned and maintaining contact | voluntary consent | Any natural person who shares health data with the Data Controller | Further details can be found in the data processing notice | primarily until the objective is achieved, or
until revoked, but no longer than the statute of limitations |
electronically, on paper, manually | Data Subjects |
|
Summary Table of Data Processing Related to Bank Information and Bank Transfers |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Facilitating and Monitoring Financial Transaction Completion | compliance with a legal obligation and/or an agreement, or voluntary consent | Any natural person to whom a bank transfer initiated by the Data Controller is made, as well as any natural person who wishes to make a financial payment to the Data Controller via a bank transfer | Further details can be found in the data processing notice/description | Until the statute of limitations expires or by the deadline specified by law | Done electronically, manually, or automatically | from our own records, from the data subjects |
|
Summary Table of Data Processing Related to Invoicing |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| compliance with a legal obligation | Compliance with legal obligations under Act CXXVII of 2007 on Value-Added Tax and the regulations issued pursuant to that Act | any natural person, including sole proprietors, whose information appears on an invoice (or an accounting document deemed equivalent) issued by the Data Controller (even if it appears in a “remarks,” “notes,” or similar field) | The categories of data set forth in Sections 169–170 and Section 176 of Act CXXXVII of 2007 | 8 years | on paper/electronically, manually | data subjects; rarely official records |
|
Summary Table of Data Processing Related to Invoice Receipt |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| full compliance with legal obligations; retention of invoices (and documents deemed equivalent thereto) pursuant to Section 179 of Act CXXVII of 2007 | jogi kötelezettség teljesítése (2007. évi CXXVII. tv. 179. §) | minden természetes személy, akinek adata az Adatkezelő által befogadott számlára (vagy azzal egy tekintet alá eső számviteli bizonylatra) vagy mellékletére rákerült | The categories of data set forth in Sections 169–170 and Section 176 of Act CXXXVII of 2007 | 8 years | on paper/electronically, manually | invoicing party |
|
Summary Table of Camera System Operations |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Purposes specified in the camera policy, such as property protection, protection of personal safety and physical well-being, etc., and identification of data subjects | the Data Controller's legitimate interest | Any natural person who enters or remains in an area monitored by a surveillance camera system | Further details can be found in the data processing notice/description | 8 days from the date of recording | electronically, automatically | Data Subjects |
|
Summary Table of Data Processing Related to the Operation of an Electronic Access Card System |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Identifying data subjects, granting and verifying their access rights, and ensuring personal and property protection and security | the Data Controller's legitimate interest | Any natural person to whom the Data Controller issues a device (e.g., a card) that grants access | Further details can be found in the data processing notice/description | Records must be deleted 180 days after the right to regular entry expires; in the case of occasional entry (when a guest card is issued), records must be deleted 1 day after departure | electronically, automatically | Data Subjects |
|
Summary Table of Data Processing Related to the Sending of Newsletters |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Providing the recipient with comprehensive, general, or personalized and regular information about the Data Controller’s latest promotions, events, and news | based on voluntary consent | Any natural person who wishes to receive regular updates about the Data Controller’s news, promotions, and discounts and who, for this purpose, subscribes to the newsletter service by providing their personal data | Further details can be found in the data processing notice/description | Until cancellation | Sign-up electronically or on paper, manually
sending electronically, automatically cancellation can be done electronically or on paper, manually. |
Data Subjects |
|
Summary Table of Data Processing Related to the Organization of a Prize Contest |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| enabling participation, identifying participants during the drawing, and maintaining contact | voluntary consent | any natural person who wishes to participate in a sweepstakes organized by the data controller by providing their personal data | Further details can be found in the data processing notice | until the objective is achieved or the statute of limitations expires | application submitted electronically, on paper, or manually
The prize draw can be conducted automatically or manually (depending on the type of draw) |
Data Subjects |
|
Summary Table related to Event Planning |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| carrying out tasks related to organizing the event and maintaining contact with the data subjects | based on voluntary consent, an agreement, or a legitimate interest | Any individual who attends an event or uses event planning services | Further details can be found in the data processing notice/description | statute of limitations | electronically and/or on paper, done manually | Data Subjects |
| Summary Table of Data Processing Related to Gift Certificates (Coupons) | ||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Enabling the purchase of gift certificates/coupons and their redemption when purchasing the Data Controller’s services/products; maintaining contact | voluntary consent, legitimate interest, agreement | Any natural person who wishes to purchase or redeem a gift certificate or coupon in connection with one of the Data Controller’s services or products | Further details can be found in the data processing notice/description | validity period
if exchanged, the statute of limitations 5 years for receipts |
electronically and/or on paper, done manually | Data Subjects |
|
Summary Table of Data Processing Related to Customer Satisfaction Surveys |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| to improve the quality of services, products, and the Data Controller’s conduct; to investigate any complaints; and to maintain contact | the Data Controller's legitimate interest | Any natural person who participates in a customer satisfaction survey as part of the Data Controller’s quality assurance process | Further details can be found in the data processing notice/description | Until the objective is achieved, or for 5 years in the event of a complaint | electronically and/or on paper, done manually | internal record of data subjects |
| Summary Table of Data Processing Related to Social Media Marketing | ||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| The Data Controller's marketing activity | Voluntary consent | Natural persons who voluntarily follow, share, or like the Data Controller’s social media page or the content posted on it | Further details can be found in the data processing notice/description | Until deletion at the request of the data subject or until the legitimate interest ceases to exist | Done electronically, manually | Data Subjects |
|
Summary Table of Data Processing Related to the Guestbook |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| to allow the data subject to express their opinion regarding the Data Controller’s services in order to improve the quality of those services and to inform others, as well as to enable the Data Controller to contact the data subject regarding any complaints | voluntary consent, in the event of a complaint | Any natural person who wishes to share their opinion with the Data Controller and others through the guestbook | Further details can be found in the data processing notice | Until deleted at the request of the data subject; in the event of a complaint, for 5 years (pursuant to Act CLV of 1997) | electronically and/or on paper, done manually | Data Subjects |
|
Summary Table of Data Processing Related to the Handling of Job Applicants' Data |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Application and Selection Process, and Communication | Voluntary consent | Any natural person who applies for a job opening advertised by the Data Controller, or who applies without a specific job opening being advertised | Further details can be found in the data processing notice/description | for the period specified in the written consent or until the legitimate interest ceases to exist | Electronically and/or on paper, done manually | Data Subjects |
|
Summary Table of Data Processing Related to Aptitude Tests |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
|
Assessment of the professional qualifications (competencies) necessary to exercise the rights and fulfill the obligations specified in the rules governing the legal relationship |
voluntary consent or legitimate interest |
Any natural person who participates in a competency test |
Further details can be found in the data processing notice/description |
Until a request for deletion is made, or until the period specified in the consent, or until the statute of limitations expires |
electronically and/or on paper, done manually |
Data Subjects |
|
Summary Table of Data Processing Related to Language Proficiency Assessment Tests |
||||||
|
Purpose |
Legal Basis |
Data Subjects |
Category of Data |
Duration |
Method |
Source |
| Identifying the specific language level of the applicant to ensure the most effective language learning | voluntary consent | Any natural person who takes the language proficiency assessment test | Further details can be found in the data processing notice | ntil the purpose is fulfilled, or until the data subject requests erasure, or—if the data subject is assigned to a specific group—on the basis of a legitimate interest (for the purposes of subsequent comparison and to reinforce language development)—the duration of data processing corresponds to the duration of the language training; subject to the statute of limitations | electronically, on paper, manually | Data Subjects |
Hungarian 
English