Privacy Notice – debreceniszallasok.hu

Effective: August 28, 2025.

1) Who is the data controller?

Name: Györfi Gyula (natural person)
Address: 4172 Biharnagybajom, Rákóczi u. 38., Hungary
Tax number: 71781662-1-29
Service provider name: GYÖRFI GYULA
Accommodation address: 4024 Debrecen, Varga utca 7, Basement level 4, 9721/2/A/4
NTAK registration number: MA25116680
Contact: via the website contact form or by post at the above address.
Data Protection Officer: not appointed (not required for this activity).

2) What data we process and for what purpose (purpose – legal basis – data processed – retention)

2.1. Booking management and fulfillment

Purpose: providing quotes, recording bookings, guest communication, performance of the contract, invoicing

Legal basis: performance of a contract (GDPR Art. 6(1)(b)); legal obligation – invoicing/accounting (GDPR Art. 6(1)(c))Data: name, email address, phone number, check-in/check-out dates, number of guests, billing details

Retention: contractual data until the contract is performed; accounting records for 8 years under the Accounting Act.

2.2. Mandatory reporting to authorities – VIZA and NTAK

Purpose: compliance with legal obligations (recording and transmitting identification document data to the VIZA system; statistical reporting to NTAK)

Legal basis: legal obligation (GDPR Art. 6(1)(c)) under the applicable government regulations

Data:

• VIZA: guest data from identification documents (document scanning). VIZA retains data for up to 2 years; the police may access it for crime-prevention/law-enforcement purposes.
• NTAK: statistical/traffic data are transmitted without personal data (NTAK and VIZA are separate systems).

Retention in the accommodation system: guest data until the last day of the first year following collection; in the VIZA system for up to two years.

2.3. Contact form

• Purpose: handling inquiries and providing responses
• Legal basis: legitimate interest (GDPR Art. 6(1)(f)) – customer communication necessary for operation
• Data: name, email address, message content
• Retention: up to 1 year after the case is closed (unless needed to establish, exercise, or defend legal claims).

2.4. Marketing (optional, only with consent)

• Purpose: newsletters, promotions
• Legal basis: consent (GDPR Art. 6(1)(a))
• Data: name, email address
• Retention: until consent is withdrawn.

3) Cookies and analytics

The website uses strictly necessary cookies for basic operation. Any non-essential (statistical/marketing) cookies are set only with prior, explicit consent, with equally prominent “Accept” and “Decline” buttons. Your choice can be changed at any time.

4) Sources of personal data

We primarily receive personal data directly from you (booking, contact form). Under the VIZA obligation, data are recorded with an ID-document reader/scanner.

5) Recipients / processors

• Authorities’ systems: VIZA (police access as provided by law), NTAK (statistical data).
• Hosting / website operations: technical operation of the website (server logs, backups).
• Email service: handling contact requests and correspondence.
• Accounting / invoicing: fulfilling accounting and tax obligations.

(Specific providers can be listed upon request. Data processing agreements are available where required.)

6) Data transfers outside the EU/EEA

As a rule, none. If any provider is located outside the EEA, transfers will occur only subject to an adequacy decision or appropriate safeguards (e.g., Standard Contractual Clauses), with separate notice.

7) Your rights

• Right of access (GDPR Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (“right to be forgotten”) (Art. 17) – subject to legal-obligation exceptions (e.g., accounting, VIZA/NTAK)
• Right to restriction (Art. 18)
• Data portability (Art. 20) – where processing is based on contract/consent
• Right to object (Art. 21) – to processing based on legitimate interests
• Right to withdraw consent – at any time; processing before withdrawal remains lawful
• Right to lodge a complaint with the supervisory authority (NAIH) and to seek judicial remedy (Arts. 77–82)

8) Supervisory authority (Hungary)

National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9–11.
Postal address: 1363 Budapest, Pf.: 9.
Phone: +36 (1) 391-1400, +36 (30) 683-5969, +36 (30) 549-6838
Email: ugyfelszolgalat@naih.hu
Website: https://naih.hu

9) Security measures

We implement appropriate technical and organizational measures (access controls, encrypted transmission, logging, up-to-date patches, backups). The VIZA system processes data in encrypted form; access is restricted by law.

10) Automated decision-making / profiling

We do not carry out automated decision-making or profiling.

11) Minors

Our services are intended for adults; for persons under 16, the declarations/procedures required by law apply (especially regarding VIZA obligations).

12) Log data

For operational security, the web server may log technical data (IP address, date/time, requested resource, browser type). Legal basis: legitimate interest (operation/security). Retention: up to 90 days, except in case of an incident.

13) Changes to this Notice

We may update this Notice from time to time; changes are indicated by updating the Effective date above.