1. PURPOSE OF THE POLICY

The purpose of this Policy is to record the data protection and data management principles applied by Peter’s Szalajka Ltd. (registered office: 3348 Szilvásvárad, Park Street 25/a; company registration number: 10-09-025382; registering authority: Heves County Court as the Court of Registration; tax number: 13012946-2-10) and to define the Company’s data protection and data management policy.

Peter’s Szalajka Ltd. (hereinafter: Service Provider), as the operator of the website www.szalajkaliget.hu (hereinafter: Website), processes the data of visitors to the Website, users who register on it, and customers (hereinafter together: Data Subjects).

The aim of this Policy is to ensure that, in all areas of the services provided by the Service Provider, all individuals—regardless of nationality or residence—have their rights and fundamental freedoms respected, in particular their right to privacy, during the automated processing of their personal data (data protection).

2. DATA CONTROLLER

Company name: Peter’s Szalajka Korlátolt Felelősségű Társaság

Registered office: 1031 Budapest, Péter utca 4.

Branch office & mailing address: 3348 Szilvásvárad, Park utca 25. A. ép.

Telephone: +36 36 564 300

Email: info@szalajkaliget.hu

Data protection registration number: NAIH-85172/2015

3. SCOPE OF PERSONAL DATA PROCESSED

3.1 Registration / Check-in form.
To use the services, in line with applicable statutory requirements, the Data Subject must provide the following personal data:

• Vehicle registration number
• Billing name
• Billing address
• Contact email address
• GUEST name
• Nationality
• ID / Passport number
• Date of birth
• Home address

Additional guest data (repeat as applicable):

• GUEST name
• Date of birth

3.2 Technical data.
During operation, the system automatically records certain data generated by the Data Subject’s device while using the service. These are logged automatically upon login and logout without any separate declaration. Except where required by law, these data cannot be linked to other personal data. Only the Service Provider has access to these data.

3.3 Cookies.
During visits to the Website, the Service Provider sends one or more cookies—small files containing a string of characters—to the visitor’s device so that the browser can be uniquely identified. These cookies are provided by Google and are used via the Google Ads/AdWords system. They are sent only when certain subpages are visited and store solely the fact and time of that visit—no other information.

Use of such cookies: third-party providers, including Google, store whether the Data Subject has previously visited the advertiser’s website and, based on this, display ads to the Data Subject on websites of Google’s partners. The Data Subject can disable Google’s cookies on the Google Ads settings page. (The Data Subject can also disable third-party providers’ cookies on the Network Advertising Initiative opt-out page.) After opting out, personalized offers from the Service Provider will no longer appear.

Types of cookies used:

• Session cookies: deleted automatically after the visit; essential for the secure and effective operation of certain functions of the Website.
• Persistent cookies: used to improve user experience (e.g., optimized navigation) and stored for a longer period in the browser’s cookie file (duration depends on the browser settings).
• Security cookies.

External servers perform independent measurement and auditing of Website traffic and other web analytics data (Google Analytics). For details on the processing of measurement data, please consult the controller’s information at www.google.com/analytics. If the Data Subject does not wish Google Analytics to measure the above data in the manner and for the purposes described, a blocking browser add-on can be installed.

Most browsers’ “Help” menu explains how to: (i) disable cookies; (ii) accept new cookies; (iii) instruct the browser to set a new cookie; or (iv) disable other cookies.

3.4 Newsletter and Loyalty (Frequent Guest) Program.
On www.szalajkaliget.hu users can subscribe to a newsletter and request a Frequent Guest Card. By using these options, the subscriber/applicant voluntarily provides the Service Provider with the following personal data:

• Name
• Email address
• Telephone number
• Postal address
• Website usage behavior
• Newsletter reading behavior
• Personal characteristics

3.7 Other processing purposes.
No other types of data recording take place.

4. LEGAL BASIS, PURPOSE, AND METHOD OF PROCESSING

4.1 Legal basis. Processing on the Website is based on the Data Subject’s voluntary, informed consent, which includes explicit consent to the use of personal data provided during use of the Website. The legal basis is Section 5(1)(a) of Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Infotv.), and Act CVIII of 2001 on certain issues of electronic commerce services and information society services. Consent is given by using the Website, completing the registration/ check-in form, and/or voluntarily providing the relevant data.

4.2 Purpose. Ensuring the provision of services available on the Website. The Service Provider processes the data provided by the Data Subject strictly for the purposes of fulfilling orders, enabling invoicing, maintaining contact, sending newsletters (if the Data Subject has subscribed), and evidencing the terms of any contract concluded.

4.3 Automatically recorded data. Used for statistical purposes, technical development of the IT system, and protection of the Data Subject’s rights.

4.4 Purpose limitation. The Service Provider does not use personal data for purposes other than those specified above. Disclosure to third parties or authorities is only possible with the Data Subject’s prior explicit consent, unless otherwise mandated by law.

4.5 Accuracy. The Service Provider does not verify personal data provided. The person supplying the data is solely responsible for their accuracy. By providing an email address, the Data Subject assumes responsibility for using the services exclusively from that address; accordingly, all liability related to logins from the provided address lies with the registrant.

5. DURATION OF PROCESSING

5.1 Processing of personal data provided during registration starts upon completion of the registration/check-in form and lasts until deletion upon request. For non-mandatory data, processing lasts from the time of provision until deletion upon request. Deletion by the Data Subject or by the Service Provider may occur at any time in the cases and manner defined in the General Terms and Conditions (GTC).

5.2 The above does not affect statutory retention obligations (e.g., accounting laws) or processing based on additional consents given during registration or otherwise.

5.3 For newsletters, processing continues until the Data Subject unsubscribes in the manner set out in Section 8.4.

6. ACCESS TO DATA, DATA TRANSFERS, AND PROCESSORS

6.1 Primarily, the Service Provider and its internal staff are entitled to access the data; they do not publish or transfer the data to third parties.

6.2 For operating the underlying IT system, fulfilling orders, and settlement, the Service Provider may use data processors (e.g., system operator, mailing provider, accountant).
Data processors:

• Barta és Barta Kft., 3300 Eger, Kisasszony u. 34. — accounting
• Karczag Tamás e.v., 3394 Egerszalók, Ifjúság út 21. B. ép. — system administration
• Magyar Posta Zrt., 1138 Budapest, Dunavirág u. 2–6. — mailing services

6.3 Peter’s Szalajka Ltd. processes personal data in a traceable manner and in compliance with legal requirements. Beyond the above, personal data are transferred to third parties only with the Data Subject’s consent, and disclosed only in response to official requests by authorities.

7. RIGHTS OF DATA SUBJECTS AND REMEDIES

7.1 The Data Subject may request information at any time about personal data processed by the Service Provider and may modify such data as specified in the GTC.

7.2 Upon request, the Service Provider provides information on the Data Subject’s personal data processed by it or by its data processor(s); their source; purpose, legal basis, and duration of processing; the name and address of the data processor and its activities; the circumstances, effects, and measures taken regarding any personal data breach; and, in case of data transfers, the legal basis and the recipient. The Service Provider provides the information in writing within 30 days of the request.

If the Service Provider has an internal data protection officer, it maintains—via the officer—a register for monitoring measures related to personal data breaches and for informing Data Subjects. The register includes the categories of personal data affected, the scope and number of Data Subjects impacted, the date, circumstances, and effects of the incident, measures taken, and any other data prescribed by law.

7.3 Contact for exercising rights:
Postal address: Peter’s Szalajka Kft., 3348 Szilvásvárad, Park utca 25/a
Customer service: info@szalajkaliget.hu
For any questions or comments related to data processing, Data Subjects may contact the Service Provider via the above.

7.4 The Data Subject may request rectification or deletion of inaccurately recorded data at any time. Certain data can be corrected by the Data Subject directly on the Website; in other cases, the Service Provider deletes the data within 3 working days of receipt of the request, after which the data cannot be restored. Deletion does not apply to processing required by law (e.g., accounting rules), which the Service Provider retains for the necessary period.

7.5 The Data Subject may request restriction (blocking) of processing. The Service Provider restricts personal data if requested by the Data Subject or if deletion would likely infringe the Data Subject’s legitimate interests. Restricted personal data may be processed only as long as the processing purpose that excluded deletion persists. Rectification, restriction, and deletion are notified to the Data Subject and to all recipients to whom the data were previously transferred, unless such notification is impossible or involves disproportionate effort or does not prejudice the Data Subject’s legitimate interests. If the Service Provider does not comply with a request for rectification, restriction, or deletion, it informs the requester in writing within 30 days of the factual and legal reasons for refusal. The Data Subject may object to the processing of personal data; the Service Provider examines the objection as soon as possible, but within 15 days, decides on its merits, and informs the Data Subject in writing.

7.6 Under the Infotv. and the Civil Code (Act V of 2013), the Data Subject may:

• Apply to the National Authority for Data Protection and Freedom of Information (1125 Budapest, Szilágyi Erzsébet fasor 22/c.; www.naih.hu), or
• Seek judicial remedy.

7.7 If, during registration or service use, the Data Subject provided a third party’s data or caused damage in any way, the Service Provider is entitled to claim compensation from the Data Subject. In such cases, the Service Provider will assist the competent authorities in identifying the infringing person to the fullest extent possible.

8. NEWSLETTER AND LOYALTY PROGRAM

8.1 The Service Provider pays special attention to the lawful use of email addresses it processes and uses them only as described below to send informational or marketing emails.

8.2 Email addresses are primarily used to identify the Data Subject and to maintain contact during order fulfillment and use of services; emails are therefore sent mainly for these purposes.

8.3 In the event of changes to services provided or to the GTC, the Service Provider may inform Data Subjects electronically by email about such changes or about similar services of the Service Provider. These notices are not used for advertising purposes.

8.4 Newsletter. Emails containing advertisements or marketing content (newsletter) are sent only with the Data Subject’s explicit consent and in compliance with legal requirements. The newsletter contains direct marketing elements. The Service Provider processes the data provided by the Data Subject for the newsletter service as long as the Data Subject does not unsubscribe by clicking the “Unsubscribe” link in the footer of the newsletter or by requesting removal via email or post. After unsubscribing, the Service Provider will no longer send newsletters or offers. The Data Subject may unsubscribe and withdraw consent at any time free of charge. Registered users may also unsubscribe at any time free of charge from their account page.

8.5 Loyalty Program & personalized newsletter. The Service Provider may use personal data to send personalized offers via newsletter. Within the personalized newsletter, the Service Provider may review previous purchases of registered and subscribed users and, based on that review, send personalized newsletters. The rules in Section 8.4 apply to unsubscribing. If the user unsubscribes from the newsletter, no further personalized newsletters will be sent.

9. MISCELLANEOUS

9.1 The Service Provider’s system may collect data on user activity that cannot be linked to personal data provided during registration, nor to data generated when using other websites or services.

9.2 If the Service Provider intends to use the provided data for a purpose other than the original purpose of collection, it informs the Data Subject in advance, obtains explicit consent, or provides the Data Subject with the possibility to prohibit such use.

9.3 The Service Provider undertakes to ensure data security and to take the technical measures necessary to protect collected, stored, and processed data, and to prevent destruction, unauthorized use, and unauthorized alteration. The Service Provider also undertakes to require any third parties to whom data may be transferred to comply with the same obligations.

9.4 The Service Provider reserves the right to unilaterally amend this Policy with prior notice on the Website interface. After the amendments enter into force, the Data Subject must accept them—via the method provided on the Website—in order to continue using the Website.

Szilvásvárad, 15 May 2018