General Terms and Conditions (GTC) - LINK

1. PURPOSE, SCOPE AND APPLICABLE LAW OF THE PRIVACY NOTICE

The purpose of this Privacy Notice is to set out the Watercolour Apartment House the data protection and data management principles and the data protection and data management policy applied by the website, which Ferenczy Ernő Ervin, as the data controller, acknowledges as binding. When drafting the provisions of the Information Notice, we have taken particular account of the provisions of Regulation 2016/679 of the European Parliament and of the Council ("General Data Protection Regulation" or "GDPR"), the 2011 Act on the Right to Information Self-Determination and Freedom of Information of the European Parliament and of the Council of 15 June 2011 on the right to information. Act CXII of 2013 ("Infotv."), Act V of 2013 on the Civil Code ("Civil Code") and Act XLVIII of 2008 on the Basic Conditions and Certain Restrictions of Commercial Advertising Activities ("Grtv."). The scope of this Privacy Notice is limited to the provisions of the https://akvarellzebegeny.hu website (hereinafter referred to as the "Website"). Unless otherwise stated, this Policy does not cover services and processing related to promotions, sweepstakes, services, other campaigns and content published by third parties advertising or otherwise appearing on the Websites. Unless otherwise stated, the scope of this Policy does not extend to the services and data processing of websites, service providers to which the Websites contain links. The scope of this Notice does not cover the processing of data by persons (organisations, companies) whose information, newsletters, advertising mailings or promotional material the User has received from the Website.

2. DEFINITIONS

Data management: any operation or set of operations which is performed on Personal Data, regardless of the procedure used, in particular the collection, recording, organisation, structuring, storage, adaptation, alteration, use, consultation, consultation, use, disclosure, transmission, dissemination or otherwise making available, disclosure, alignment or combination (including profiling), restriction, erasure and destruction of Personal Data.

Data Controller: the person, as defined in point 3, who, alone or jointly with others, determines the purposes and means of the processing.

Personal data or information: any data or information that allows a natural person User to be identified, directly or indirectly.

Data Processor: the service provider who processes personal data on behalf of the Data Controller.

User: the natural person who provides on the Website the data listed in points 8 and 9 below.

External service provider: third party service partners used by the Data Controller or the Website Operator, either directly or indirectly, in connection with the provision of certain services, to whom Personal Data are or may be transferred or who may transfer Personal Data to the Data Controller for the provision of their services. Third party service providers are also those service providers that are not in cooperation with the Controller or the operators of the services, but by accessing the Website, collect data about Users, which may be used to identify the User, either individually or in combination with other data. Furthermore, in providing the hosting service, the Data Controller also considers the User as an External Service Provider for the purposes of the data management activities carried out on the hosting service it uses.

Factsheet: this Privacy Notice of the Data Controller.

3. THE IDENTITY AND ACTIVITIES OF THE CONTROLLER

name: Ernő Ervin Ferenczy
seat: 2627 Zebegény, Csalogány út 1.
phone: +36-70-380-6528
e-mail: foglalas@akvarellzebegeny.hu
Data protection officer: Ernő Ervin Ferenczy
Title of data protection officer: self-employed

Tax number: 75652960-2-33

The Data Controller is an individual entrepreneur based in Hungary.

The Data Controller operates the Website.

4. THE PRINCIPLES, METHODS OF DATA PROCESSING AND APPLICABLE LAW

4.1 The Data Controller shall act in good faith, fairness and transparency, in cooperation with the Users in the course of data processing. The Data Controller processes only the data specified by law or provided by Users for the purposes set out below. The scope of the Personal Data processed shall be proportionate to the purposes of the processing and shall not go beyond those purposes.

4.2 In all cases where the Data Controller intends to use the Personal Data for a purpose other than that for which it was originally collected, the Data Controller shall inform the User thereof and obtain his or her prior explicit consent or provide the User with the opportunity to prohibit such use.

4.3 The Controller does not verify the Personal Data provided to it. The person providing the Personal Data is solely responsible for the correctness of the Personal Data provided.

4.4 The Personal Data of a person under the age of 16 may be processed only with the consent of the person who is the legal guardian of the person concerned. The Data Controller is not in a position to verify the eligibility of the person giving consent or the content of the consent, so the User or the person who is the legal guardian of the person concerned guarantees that the consent is in accordance with the law. In the absence of a declaration of consent, the Data Controller shall not collect Personal Data relating to a data subject under the age of 16.

4.5 The Data Controller shall not transfer the Personal Data it processes to third parties other than the Data Processors specified in this Notice and, in certain cases referred to in this Notice, to External Service Providers.

An exception to the provisions of this point is the use of data in aggregate statistical form, which may not contain any other data that can identify the User concerned, and therefore does not constitute Data Processing or data transfer.

In certain cases, the Data Controller may make available to third parties the available Personal Data of the User concerned, in response to a formal judicial or police request, legal proceedings, or due to a reasonable suspicion of infringement of copyright, property rights or other rights, or due to a threat to the interests of the Data Controller, or to the provision of the service, etc.

The Data Processors of the Data Controller listed in this Privacy Notice and the External Service Providers shall, after 25 May 2018, record, process or process the Personal Data transferred to them by the Data Controller and processed or processed by them in accordance with the provisions of the GDPR and shall make a declaration to the Data Controller to that effect.

4.6 The Data Controller shall notify the User concerned of the rectification, restriction or deletion of the Personal Data processed by it, as well as all those to whom the Personal Data was previously transmitted for the purpose of processing. The notification may be omitted if this does not prejudice the legitimate interests of the User with regard to the purpose of the Processing.

4.7 In view of the relevant provisions of the GDPR, the Data Controller is not obliged to appoint a Data Protection Officer, as the Data Controller is not a public authority or a body with public responsibilities, the activities of the Data Controller do not involve operations that require systematic and systematic large-scale monitoring of Users, and the Data Controller does not process sensitive data or personal data relating to criminal convictions and offences.

4.8 The Data Controller shall process personal data in accordance with applicable law. The legislation governing the processing of personal data includes in particular:

• Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (hereinafter referred to as "the Infotv.");
• Act XLVIII of 2008 on the Fundamental Conditions and Certain Restrictions of Economic Advertising Activities (hereinafter referred to as "Grtv.");
• Regulation 2016/679 of the European Parliament and of the Council;
• Act CVIII of 2001 on certain aspects of electronic commerce services and information society services;
• Article 169 of Act C of 2000 on Accounting (concerning the retention of supporting documents).

5. LEGAL BASIS FOR PROCESSING

5.1.Taking into account the nature of the Data Controller's activities, the legal basis for data processing is the voluntary, explicit consent of Users based on appropriate information (Infotv. 5 (1) (a)), the fulfilment of the legal conditions applicable to the accommodation service and, in the case of profiling, the appropriate information of the User in accordance with the provisions of the GDPR, as well as Article 6 (1) (f) of the GDPR. The Users voluntarily contact the Data Controller, voluntarily book accommodation, voluntarily register, voluntarily use the services of the Data Controller. In the absence of the Users' consent, the Data Controller shall process data only if expressly authorised to do so by law.

5.2 The User has the right to withdraw his/her consent at any time. The withdrawal of consent shall not affect the lawfulness of the processing based on consent prior to its withdrawal.

5.3.The Data Controller records the IP address of the User when the User accesses certain websites in connection with the provision of the service, with regard to the legitimate interest of the Data Controller and for the lawful provision of the service (e.g. to filter unlawful use or unlawful content), even without the User's consent.

5.4. Transfers of Data to Processors as set out in this Policy may be made without the User's specific consent. Unless otherwise provided by law, the disclosure of personal data to third parties or public authorities is only possible on the basis of a final decision by a public authority or with the prior express consent of the User.

5.5. When providing any User's e-mail address and the data provided when requesting an offer or ordering accommodation services (e.g. name, telephone number, etc.), the User also assumes responsibility for the fact that only the User will use the e-mail address and the data provided by the User to order services. With regard to this assumption of responsibility, any liability in connection with a request for an offer or service made from the e-mail address and/or data provided shall be borne solely by the User who provided the e-mail address and the additional data.

5.6 The legal basis for processing is in certain cases a legal provision. The main legislation that also provides for data processing is the legislation set out in section 4.8. The data contained in the receipt issued by the Data Controller shall be processed by the Data Controller in accordance with the Accounting Act.

5.7 The legal basis for the processing may be the substantial legitimate interests of the Controller, in which case, in accordance with the relevant provisions of the GDPR, the Controller has carried out and may continue to carry out an interest test demonstrating that the processing is necessary for the purposes of the legitimate interests pursued by the Controller and that those interests are not overridden by the rights and freedoms of the data subject which require the protection of personal data. The Controller shall, upon request, provide the data subject with the information referred to in this paragraph as set out in this Notice.

6. THE PURPOSE OF THE PROCESSING

The Data Controller processes personal data only for specific purposes, for the exercise of rights and the performance of obligations. At all stages of the processing, it shall comply with the purpose of the processing. The data are collected and processed fairly and lawfully. The Data Controller shall endeavour to process only personal data that is necessary for the purpose of the processing and is adequate for the purpose. Personal data shall only be processed to the extent and for the duration necessary to achieve the purpose.

The purpose of data processing is primarily the operation of the Website and the provision of the Controller's services.
The purpose of the processing based on the above:

• identifying the User, contacting the User;
• to fulfil the obligations incumbent on the Data Controller, to exercise the rights of the Data Controller;
• advertising, research, if the User has given his/her specific consent;
• analyses, statistics, development of services - for these purposes, the data controller uses only anonymised data, aggregated data that cannot be personally identified;
• protect the rights of Users.

7. SOURCE OF DATA

The Data Controller processes only the personal data provided by the Users and does not collect data from other sources.
The data is provided when the User subscribes. The User fills in the form during the booking process, where he/she provides his/her name, e-mail address and telephone number.

8. SCOPE OF THE DATA PROCESSED

The Data Controller processes only the personal data provided by Users. The data processed are the following:

surnames, first names, nicknames, e-mail address, mobile phone number, contact name, contact email address, contact phone number.

In addition to the above, the Data Controller processes technical data, including the IP address, as described in point 12.

9. DESCRIPTION OF THE DATA MANAGEMENT PROCESS

The source of the data is the User, who provides the data when requesting an offer or ordering (booking) an accommodation service. The provision of the data on the request for quotation and service order forms is mandatory, unless expressly indicated otherwise.

The User provides the data independently, the Data Controller does not give any mandatory guidelines or content requirements. The User expressly consents to the processing of the data provided by him. In addition to the data requested by the Data Controller, the User is entitled to provide other data in his/her profile, the legal basis for the processing of the data in this case is also the voluntary consent of the User.

If the User registers for a promotion organised by the Data Controller (e.g. on Facebook) and provides the data requested there, the User accepts the data management information related to the promotion. In this case, by providing the data, the User does not register on the Website, but consents to the processing of the data provided as set out in the promotion's prospectus.