DATA PRIVACY NOTICE

In accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council (April 27, 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as GDPR), we hereby inform you with this notice and process description about all relevant facts regarding the processing of your personal data. By participating in the process, you, as the data subject, become subject to data processing in accordance with this process description.

DATA CONTROLLER’S EXACT DESIGNATION AND CONTACT DETAILS:

Primary Data Controller:
Name: Cuppon Ferenc
Registered Office: 8315 Gyenesdiás, Béke utca 27
Mailing Address: 8315 Gyenesdiás, Béke utca 27

Secondary Data Controller:
Name: Cuppon Endre
Registered Office: 8315 Gyenesdiás, Tücsökdomb utca 2
Mailing Address: 8315 Gyenesdiás, Tücsökdomb utca 2

Website: www.cserszegikockak.hu
Email Address: info@cserszegikockak.hu
Phone Number: +36 309898095

PRIVACY NOTICE AND PROCESS DESCRIPTION FOR WEBSITE USERS

PURPOSE OF DATA PROCESSING:
Automatic collection of personally identifiable data of website visitors concerning login details and usage patterns using Google Analytics.

LEGAL BASIS FOR DATA PROCESSING:
Consent of the data subject pursuant to Article 6(1)(a) of the GDPR.

CATEGORIES OF PERSONAL DATA PROCESSED:
IP address, duration of visit, geographical data, user behavior, browser and operating system type (depending on computer settings).

TRANSFER OF DATA TO THIRD PARTIES:
The Data Controller does not transfer the data to third parties. However, data subjects are advised that the disclosure of personal data to courts and authorities may be required by law. If the Data Controller is obliged by a court or authority, in accordance with statutory procedures, to transfer personal data, it is required to comply and provide the requested data.

DURATION OF DATA STORAGE:
Until the purpose of data processing is fulfilled or until the data subject withdraws consent.

AUTOMATED DECISION-MAKING:
No automated decision-making occurs during data processing.

DESCRIPTION OF THE DATA PROCESSING PROCEDURE:
The Data Controller operates its own website at www.cserszegikockak.hu. The website automatically collects personally identifiable information about visitors through Google Analytics (IP address, duration of visit, geographical data, user behavior, etc.), which serves statistical purposes related to website traffic. However, the Data Controller does not link visitor IP addresses with other data.

Visitors have the option to subscribe to newsletters and request personalized offers. Subscription to newsletters requires explicit and active consent. The Data Controller ensures the security of stored personal data and takes all necessary technical and organizational measures to enforce the GDPR and other data and confidentiality regulations. The data is protected against unauthorized access, alteration, transmission, disclosure, deletion, or destruction, as well as accidental loss or damage.

PRIVACY NOTICE AND PROCESS DESCRIPTION FOR ELECTRONIC MONITORING SYSTEM DATA PROCESSING

PURPOSE OF DATA PROCESSING:
The purpose of surveillance cameras is to protect individuals and property in the parking area and reception.

LEGAL BASIS FOR DATA PROCESSING:
Processing is necessary for the legitimate interests of the Data Controller or a third party (Article 6(1)(f) of the GDPR).

CATEGORIES OF PERSONAL DATA PROCESSED:
Image of the data subject and data obtained from camera footage (location, duration of stay).

TRANSFER OF DATA TO THIRD PARTIES:
The Data Controller does not transfer data to third parties. However, in case of legal obligation, data must be provided to courts and authorities.

DURATION OF DATA STORAGE:
Footage is deleted after 15 days unless required for use.

AUTOMATED DECISION-MAKING:
No automated decision-making occurs during data processing.

DESCRIPTION OF THE DATA PROCESSING PROCEDURE:
The Data Controller operates an electronic monitoring system for security purposes under Act CXXXIII of 2005 on the Rules of Personal and Property Protection and Private Investigation. Camera footage is accessible only to authorized personnel and is subject to access control measures. All access and restrictions to recorded footage are documented for accountability purposes.

Camera Locations

Camera Location	Monitored Area	Individuals in Monitored Space	Purpose of Surveillance
Reception	Reception Desk	Guests and Employees	Personal and Property Protection
House 1 and 5 & Reception Side Wall	Parking Areas	Guests	Personal and Property Protection

PRIVACY NOTICE AND PROCESS DESCRIPTION FOR GUEST SERVICE DATA PROCESSING

PURPOSE OF DATA PROCESSING:
The Data Controller processes personal data of customers to the extent necessary for service provision.

LEGAL BASIS FOR DATA PROCESSING:
Performance of a contract (Article 6(1)(b) of the GDPR).

CATEGORIES OF PERSONAL DATA PROCESSED AND PURPOSE:

Data Category	Purpose of Processing
Last Name	Identification, Communication
First Name	Identification, Communication
Email Address	Identification, Communication
Phone Number	Communication
Case Information	Service Management

TRANSFER OF DATA TO THIRD PARTIES:
The Data Controller does not transfer data to third parties unless required by law.

DURATION OF DATA STORAGE:
Data is stored until the last day of the year following the year it was obtained. Thereafter, data is deleted. The VIZA system retains submitted data for a maximum of two years.

DESCRIPTION OF THE DATA PROCESSING PROCEDURE:
The hosting service provider, acting as the data processor for the accommodation provider, is responsible solely for storing the data in encrypted form and ensuring access is granted only to authorized entities. Guest data is encrypted and entered into the VIZA system, which can only be accessed by competent authorities. Neither the hosting service provider nor the document scanning software operator has access to stored data.

This privacy notice is subject to amendments in compliance with regulatory changes or operational modifications in data processing procedures.