MEDUZA Commercial, Tourism, and Hospitality Limited Liability Company (registered office: 1061 Budapest, Jókai tér 9; tax number: 10592229-2-42; hereinafter: “Company”) has created and made available this Privacy Policy (hereinafter: “Policy“) to ensure the realization of the right to information for data subjects as defined in Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: “GDPR“), as well as in Act CXII of 2011 on Informational Self-Determination and Freedom of Information (hereinafter: “Infotv.“).

The material scope of the Policy extends to all processes carried out in all organizational units of the Company where personal data processing takes place.

The temporal scope of the Policy remains in effect until its revocation. The Company reserves the right to amend this Policy and will provide notice of such amendments by publishing the revised Policy on its website.

I. Data Controller

The data controller is: MEDUZA Commercial, Tourism, and Hospitality Limited Liability Company

Registered office of the company: 1061 Budapest, Jókai tér 9.

Company registration number: 01-09-919221

Tax number: 10592229-2-42

Phone number: +36(34)342304

Email address: info@medoszhotel.hu

II. General Definitions

1. data subject: any natural person who is identified or identifiable on the basis of any information (a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person);
2. personal data: any information relating to an identified or identifiable natural person (data subject) (such data that can be linked to the data subject includes, in particular, the data subject’s name, identification number, and one or more pieces of information characteristic of their physical, physiological, mental, economic, cultural, or social identity, as well as conclusions drawn from the data concerning the data subject);
3. special category data: all data belonging to special categories of personal data, namely personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, health data, and data concerning a natural person’s sex life or sexual orientation;
4. data controller: the natural or legal person, or organization without legal personality, which – within the framework defined by law or by a binding legal act of the European Union – alone or jointly with others determines the purposes of data processing and makes and implements decisions concerning data processing (including the means used), or has them implemented by a data processor;
5. data processing: any operation or set of operations performed on data, regardless of the procedure applied, such as collection, recording, registration, organization, storage, alteration, use, retrieval, transmission, disclosure, alignment or combination, blocking, deletion, and destruction, as well as preventing the further use of data, taking photographs, audio or video recordings, and recording physical characteristics suitable for identifying a person (e.g., fingerprints or palm prints, DNA samples, iris images);
6. data processor: the natural or legal person, or organization without legal personality, which – within the framework and under the conditions defined by law or by a binding legal act of the European Union – processes personal data on behalf of or under the instructions of the data controller;
7. data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

Additional referenced legislation:

• Szvmt.: Act CXXXIII of 2005 on the Rules of Personal and Property Protection and Private Investigation Activities
• Szvt.: Act C of 2000 on Accounting

III. Data Processing Activities of the Company

	Description of Data Processing	Purpose of Data Processing	Legal Basis for Data Processing	Duration of Data Processing
WEBSITE VISITS	Providing personal data is not required to view information published for the public on the Company’s website at http://medoszhotel.hu. The Company uses Google Analytics cookies to analyze visitor preferences in order to ensure the user-friendly nature of the website (e.g., the number of visitors to the website and subpages, the duration of visits, the order in which pages are viewed, the search terms used to access the site, the browser type, the geographic location of the computer). The Company does not collect personal data about website visitors. The cookies used on the website only record the anonymous IP address of the visitor’s computer and do not collect any personal data that could be used to identify an individual.	In connection with this activity, the Company does not process any personal data other than the visitor’s anonymized IP address.	In connection with this activity, the Company does not process any personal data other than the visitor’s anonymized IP address.	The _NID cookies used by Google Analytics are stored for 6 (six) months following the expiration of the session.
QUOTE REQUESTS	In the event of an inquiry or quote request made through the Company’s website, in person, by email, or by telephone, the following personal data must be provided in addition to information related to the planned stay: name, email address, or phone number.	The purpose of data processing is to establish contact and maintain communication, as well as to provide information and send quotes.	The legal basis for data processing is the data subject’s consent [GDPR Article 6(1)(a)], as well as the legitimate interest of the data subject and the Company [GDPR Article 6(1)(f)].	The duration of data processing lasts until the data subject’s deletion request or until the data subject withdraws their consent.
BOOKING, PAYMENT	In connection with bookings and payments made through the Company’s website, in person, by email, or by telephone, the Company processes personal identification data, address data, contact information, and vehicle registration numbers necessary for issuing receipts in accordance with Szvt. 169. If the guest is from a third country, the Company is obligated by law to record additional data, which are as follows: personal identification data (birth name, place and date of birth, gender, mother’s birth name, nationality); travel document identification data; the address of the accommodation; the start and end dates of accommodation use; visa/residence permit number and the date and place of entry.	The purpose of data processing is to conclude and fulfill the contract between the Company and the guest, maintain contact, provide parking, and issue invoices.	The legal basis for data processing is the data subject’s consent [GDPR Article 6(1)(a)], as well as the conclusion and performance of the contract between the data subject and the Company [GDPR Article 6(1)(b)].	The duration of data processing is 8 (eight) years following the fulfillment of the contract, in accordance with the legal requirements for retaining receipts under Szvt.
PROCESSING OF JOB APPLICANT DATA	The Company processes personal data contained in unsolicited and targeted resumes and attached documents received directly or through employment agencies.	The purpose of data processing is to notify the data subject of job opportunities that best match their qualifications and interests, to schedule appointments with the data subject, and to conduct the selection process.	The legal basis for data processing is the data subject’s voluntary consent [GDPR Article 6(1)(a)], which the data subject provides by submitting their resume and related documents.	The duration of data processing is the duration of the employment relationship in the case of a successful application; in the case of an unsuccessful application, the application materials of unsuccessful applicants are deleted following the selection process.
DATA PROCESSING RELATED TO CAMERA SURVEILLANCE	The Company operates an electronic surveillance and recording system in areas marked with camera pictograms or warning notices at its registered office (monitored areas). The camera system monitors the common areas of the hotel and restaurant. The camera surveillance system records the images and actions of persons entering the monitored areas. The camera surveillance system does not record audio. Only authorized employees of the data controllers are entitled to view the current images and recordings from the cameras. The camera system is operated by the Company without the use of a service provider, so only the Company qualifies as the data controller.	The purpose of data processing is property protection and the protection of persons in the building, the protection of business secrets, and the proof of any abuses or violations.	The legal basis for data processing is based on the data subject’s voluntary consent (by entering the building) [GDPR Article 6(1)(a)], as well as on the legal authorization provided by Szmvt. 30-32. sections.	The duration of data processing is 30 (thirty) days from the time the recording is made, after which the recordings are automatically deleted in accordance with Szvt. 31. Section (3)(c) (given that the Company stores and handles significant amounts of cash as defined in Act C of 2012 on the Criminal Code in connection with its hotel and hospitality activities).

IV. Persons Authorized to Access the Data

Personal data may be accessed at the Company by employees with access rights related to the relevant data processing purpose, as well as by persons and organizations performing data processing or outsourced activities for the Company under service contracts, to the extent determined by the Company and to the extent necessary for the performance of their activities.

During data processing activities, the Company uses the services of the following data processors under service contracts.

1. Alcor-Conto Limited Liability Company (registered office: 2009 Pilisszentlászló, Tölgyfa utca 43.; tax number: 23067246-2-13)

The above company provides accounting and payroll services for the Company, and therefore performs data processing activities with respect to receipts issued by the Company (and the personal data processed therein), as well as data processed in connection with payroll.

• Navarino Services Ltd (registered office: Navarino House, Network Point, Range Road, Witney, Oxfordshire, OX29 0YN, United Kingdom)

The above company provides the Company’s online booking platform and therefore qualifies as a data processor with respect to guest booking data.

• MT-HOSTWARE Computer Technology Limited Liability Company (registered office: 1149 Budapest, Róna utca 120-122.; tax number: 10426917-2-42)

The above company provides the Hostware hotel management software to the Company and performs electronic data processing activities for the Company in this capacity.

V. Rights Related to Data Processing and Their Exercise

5.1. Right to Information and Access

The data subject may request in writing that the Company provide information on:

1. what personal data,
2. on what legal basis,
3. for what data processing purpose,
4. from what source,
5. for how long the Company processes,
6. to whom, when, on what legal basis, and to which of the data subject’s personal data the Company has provided access or to whom it has transmitted the data subject’s personal data.

The Company will fulfill the data subject’s request within a maximum of 15 (fifteen) days by sending an electronic or postal letter to the contact information provided by the data subject. Prior to fulfilling the request, the Company may ask the data subject to clarify the content of the request and to specify precisely the information or data processing activities requested.

If the data subject’s right of access under this section would adversely affect the rights and freedoms of others, in particular the business secrets or intellectual property of others, the Company is entitled to refuse to fulfill the data subject’s request to the extent necessary and proportionate.

If the data subject requests the above information in multiple copies, the data controller is entitled to charge a reasonable fee proportionate to the administrative costs of producing the additional copies.

If the Company does not process the personal data specified by the data subject, it is obligated to inform the data subject of this in writing.

5.2. Right to Rectification

The data subject may request in writing that the Company modify personal data that is inaccurate, incorrect, or incomplete. In this case, the Company will correct or rectify the specified personal data without delay, but no later than within 5 (five) days, or, if compatible with the purpose of data processing, supplement it with additional personal data provided by the data subject or with a statement made by the data subject regarding the processed personal data. The Company will notify the data subject of this by sending an electronic or postal letter to the contact information provided by the data subject.

The Company is exempt from the obligation to rectify if:

1. accurate, correct, or complete personal data are not available and the data subject does not provide them to the Company, or
2. the authenticity of the personal data provided by the data subject cannot be established beyond doubt.

5.3. Right to Erasure

The data subject may request in writing that the Company erase their personal data. The data subject must submit the erasure request in writing and must specify which personal data they wish to have erased and for what reason.

The Company will reject the erasure request if any law requires the Company to continue storing the personal data. If the Company has no such obligation, it will fulfill the data subject’s request within a maximum of 15 (fifteen) days and will notify the data subject by sending an electronic or postal letter to the contact information provided by the data subject.

5.4. Right to Blocking

The data subject may request in writing that the Company block their personal data. Blocking lasts as long as the reason specified by the data subject makes data storage necessary. The data subject may request blocking of data, for example, if they believe that the Company has processed their personal data unlawfully, but it is necessary for the Company not to delete the personal data for the purposes of an official or judicial proceeding initiated by the data subject. In this case, the Company will continue to store the personal data until contacted by the authority or court, after which it will delete the data and notify the data subject by sending an electronic or postal letter to the contact information provided by the data subject.

5.5. Right to Restriction of Processing

The data subject may request in writing that the Company restrict the processing of their personal data. During the restriction period, the Company and any data processor commissioned by or acting under the instructions of the Company may perform data processing operations other than storage on the personal data subject to restriction only for the purpose of asserting the data subject’s legitimate interest or as specified by law. The data subject may request restriction of processing for as long as:

1. the data subject contests the accuracy, correctness, or completeness of the personal data processed by the Company or the data processor, and the accuracy, correctness, or completeness of the processed personal data cannot be established beyond doubt (for the duration of clarifying the existing doubt),
2. erasure of the data would be appropriate, but based on the data subject’s written statement or information available to the Company, it can be reasonably assumed that erasure of the data would harm the data subject’s legitimate interests (for the duration of the legitimate interest justifying the omission of erasure),
3. erasure of the data would be appropriate, but preservation of the data as evidence is necessary in proceedings conducted by or with the participation of a public authority (until the conclusion of the investigation or proceeding).

In the event of restriction, personal data may only be processed, with the exception of storage, with the consent of the data subject or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State of the European Union.

The Company shall inform the data subject in advance of the lifting of the restriction on data processing.

Following the fulfillment of the data subject’s request to exercise their right to restriction, the Company shall promptly inform the recipients with whom it has communicated the data subject’s personal data, unless this proves impossible or requires disproportionate effort from the Company. Upon request, the Company shall inform the data subject of these recipients.

5.6. Right to remedy

5.6.1. Dispute resolution with the Company

Data subjects may submit their objections and requests regarding the processing of their personal data to the Company verbally (in person) or in writing (in person or through a document delivered by another person, or by post or email) at the contact details specified in Section I under the Data Controller’s designation.

5.6.2. Right to lodge a complaint

If you have been unable to resolve your objection, complaint, or request regarding your personal data with the Company in a satisfactory manner, or if at any time you believe that a violation of rights has occurred or there is an imminent risk thereof in connection with the processing of your personal data, you are entitled to lodge a complaint with the National Authority for Data Protection and Freedom of Information.

Contact details of the National Authority for Data Protection and Freedom of Information

Registered office: 1125 Budapest, Szilágyi Erzsébet fasor 22/c. Mailing address: 1530 Budapest, P.O. Box 5

Telephone: +36(1)3911400

Fax: +36(1)3911410

Email: ugyfelszolgalat@naih.hu

Website: naih.hu

5.6.3. Right to bring proceedings before a court (right to initiate legal action)

The data subject may – independently of their right to lodge a complaint – bring proceedings before a court if their rights under the GDPR or the Data Protection Act have been violated during the processing of their personal data.

Proceedings may be brought before a Hungarian court against the Company as a data controller with a place of business in Hungary.

The data subject may also bring proceedings before the regional court of their place of residence. In Hungary, the contact details of regional courts can be found at the following link: http://birosag.hu/torvenyszekek.

VI. Other information

6.1. Exercise of rights relating to personal data following the death of the data subject

Within five years following the death of the data subject, the rights that belonged to the deceased during their lifetime may be exercised by a person authorized by the data subject through an administrative disposition or a declaration made to the data controller (in a public document or a private document with full probative force). If the data subject has not made such a declaration, the rights that belonged to the deceased during their lifetime may be exercised by the data subject’s close relative under the Civil Code within five years following the death of the data subject (in the case of multiple close relatives, the close relative who first exercises this entitlement is authorized to exercise the above rights).

6.2. Special provisions regarding camera recordings

6.2.1. Right to request information

The data subject may request information within 30 (thirty) days from the creation of the recording about what is visible on the recording in relation to the data subject. The request must specify where and at what time the recording was made and how the data subject can be identified. The Company shall fulfill the request within 15 (fifteen) days.

6.2.2. Right to blocking

Within 30 (thirty) days from the creation of the recording, the data subject may request, by demonstrating their right or legitimate interest, that the data controllers not destroy or delete the data (blocking). The request must specify where and at what time the recording was made, how the data subject can be identified, and the reason for requesting blocking. Simultaneously with blocking, it is advisable for the data subject to initiate the necessary official or court proceedings, as the Company only releases recordings upon official or court request.

6.2.3. Right to access

Within 30 (thirty) days from the creation of the recording, the data subject may request to view the recordings made of them. The request must specify where and at what time the recording was made, how the data subject can be identified, and on which day they wish to view the recording. The Company can provide access on business days from Monday to Friday, between 9 a.m. and 3 p.m.