Name: Zalakaros Family, Experience and Spa Zrt.
Title: 8749 Zalakaros, Termál út 4.
Representative of the Data Controller: Andor János Végh CEO
Contact details of the Data Controller regarding data protection:
This notice is a unilateral undertaking by the controller in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and the applicable national law of the Member States. This Policy may be unilaterally amended and/or withdrawn at any time by the Data Controller, by informing the Data Subjects at the same time. The information shall be provided by publication on the website or, depending on the nature of the change, by direct notification to the Data Subjects.
Legal basis for processing: consent of the data subject, fulfilment of a legal obligation.
We will process, collect, record, organise, use and store your personal data only to the extent necessary and in any case for the purposes for which it is collected, based on your prior informed and voluntary consent. In the event of non-disclosure, the Data Controller will not be able to provide the service ordered. In some cases, the processing of your data is based on legal requirements and is mandatory. In such cases, we will draw your attention to this fact. Furthermore, in certain cases, our Company or a third party may have a legitimate interest in the processing of your personal data, such as the operation, development and security of our website.
Scope of the data processed:
(1) The legal basis for the processing of data in the case of contact, guestbook, prize draw and newsletter is the consent of the data subject, which the data subject shall provide on the Company's website at the
https://zkf.hu/hirlevel-feliratkozas
https://zkf.hu/ifjusagi-szallas/form
https://zkf.hu/nyeremenyjatek-szabalyzat
links by ticking the box next to the text and entering a security code to provide information about the processing of your data.
(2) The data subject is any natural person who clicks on a link of the Company or registers on the website and gives his/her consent to the processing of his/her personal data.
(3) Data processed in case of contact: name, e-mail address, telephone number.
(4) Data processed in the case of a guestbook: name, e-mail address, municipality.
(5) Data processed in the case of newsletter subscriptions: name, e-mail address.
(6) The purpose of data processing: to inform the data subject about the Company's services, products, changes in them, news and events.
(7) The purpose of data processing in case of contact: information, provision of free services on the website to the data subject, access to non-public content of the website.
(8) The recipients of the data (who may have access to the data) are the contact person, the employees of the data processor operating the Company's website.
(9) The data subject may request the deletion of his/her registration (personal data) at any time.
For the maintenance and management of our website, our Company uses a data processor who provides IT services (hosting service) and, within the framework of this, processes the personal data provided on the website for the duration of our contract with him/her, and the operation performed by him/her is the storage of personal data on the server.
Our IT service provider:
Company name: MORGENS Design Kft.
Registered office: 8800 Nagykanizsa, Magyar utca 79.
Company registration number: 20 09 072782
Tax number: 23964710-2-20
Representative: managing director Zoltán Katona
Phone number: +36 30 648 0047
E-mail address: sales@morgens.hu
Website: www.morgens.hu
Legal basis for processing: Compliance with the law (VAT Act, Accounting Act, Personal Income Tax Act). Provision of data is a condition for the conclusion of the contract. Failure to provide the data will result in the Data Controller being unable to provide the service ordered.
Scope of the data processed:
Possible consequence of not providing the data: failure of the service. Intended time limit for processing: expiry of the service + rules on the time limit for keeping documents required by law.
Operation of a camera system at the Company's headquarters and premises.
Legal basis for processing: consent of the data subject to enter the Data Controller's territory despite the invitation to be monitored by a camera. The Data Controller shall carry out the activity in accordance with the provisions of Act CXXXIII of 2005 on the Protection of Persons and Property and the Rules of Private Investigation (Act on the Protection of Persons and Property and the Rules of Private Investigation).
Scope of the data processed:
With regard to the recordings made by the electronic surveillance system, the Data Controller applies the following retention periods:
After the storage period has expired, the recordings are destroyed.
Data management, data transfer records, data protection incidents, Data subjects' claims, issues
Legal basis for processing: Legal obligation
About services, location, programmes, catering, accommodation. Legal basis for processing: Legitimate interest - The legitimate interest of the controller is the direct marketing. Scope of data processed: e-mail address, name. By using a service, the data subject has provided the controller with the following data. The data controller informs the data subject in this notice of the data processed along the lines of the activities recorded, reclassifies the purpose of the processing on the basis of legitimate interest and uses it for direct marketing purposes. Planned deadline for data processing: Until protest.
Natural persons acting on behalf of natural persons or legal persons who use the services of the controller, and the contact persons of partners under contract with the controller.
The data controller transfers the data to the data processor(s) contracted by the data controller for the performance of the contract. The categories of recipients are IT operators, web hosting providers, web content developers.
The data controller shall not disclose the data to third parties, with the exception of the data processor(s) referred to in point 5. Only employees of the controller and designated employees of the processor(s) shall have access to the recorded data. The Data Protection Officer, the IT Operator and the CEO shall have access to the recordings previously made by the electronic surveillance (camera) system. The Data Subject shall, upon request, have access only to the recordings made of him or her in the presence of one of the above-mentioned persons. In all cases, access must be requested in writing to the Data Protection Officer. The Data Controller shall in all cases draw up a record of the fact of access, which shall be kept by the Company for a period of 1 year.
Restrictions on the recordings made by the electronic surveillance system may only be implemented in cases where the Data Controller has detected an event that is likely to jeopardise the purpose of the electronic surveillance system.
At the Data Subject's request, the processing of images of him or her may be restricted to the processing of images of him or her. The Data Subject must request the blocking in writing to the Data Protection Officer, indicating the purpose and the expected duration of the blocking. The Data Controller shall keep a record of each step of the blocking process for a period of 1 year.
If the Partner does not provide his/her own data to the Data Controller, but that of another natural person, the User/Partner shall be solely responsible for having provided the data with the consent, knowledge and due information of this natural person. The Data Controller is not obliged to verify the existence of these. The Data Controller draws the attention of the Partner to the fact that if the Data Subject fails to comply with his/her obligations and therefore asserts a claim against the Data Controller, the Data Controller may pass on the asserted claim and the amount of the related damage to the Partner.
The Data Subject may also send it to the Controller at one of the contact addresses indicated in point 1.
The Data Controller shall process or reject (with reasons) the notification within 1 month of the request being made at the latest, or in exceptional cases within a longer period permitted by law. The Data Subject shall be informed in writing of the outcome of the investigation.
The Company shall, for the first time, take the measures and provide the necessary information free of charge provides. If the Data Subject requests the same data for a second time within one month and the data have not changed during this period, the Data Controller will charge an administrative fee.
If the data subject's request is clearly unfounded, if he or she is not entitled to receive the information or if the Company as data controller can prove that the Data Subject has the requested information, the data controller shall reject the request for information. If the data subject's request is excessive, in particular because of its repetitive nature, the Company may refuse to act on the request if
The data subject has the right to object at any time to the processing of his or her personal data on the basis of a legitimate interest or on the basis of a legal basis involving public authority. In such a case, the Company may no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. If it finds that the grounds for the objection are justified, it shall, as soon as possible, stop the processing, including the transfer and further processing. It shall inform all those to whom it has previously transferred the Data Subject's data of the objection. The processing of the request shall be free of charge, except for unfounded or excessive requests, for which the Data Controller may charge a reasonable fee corresponding to its administrative costs. If the Data Subject disagrees with the decision taken by the Controller, he or she may take the matter to court. Data protection litigation shall be subject to the jurisdiction of the courts, which may, at the choice of the Data Subject, be brought before the courts for the place of residence or domicile of the Data Subject. A foreign national may also lodge a complaint with the competent supervisory authority in his/her country of residence.
The controller shall not disclose to the public the recordings of the electronic surveillance system.
The Data Controller will NOT transfer the Data Subject's personal data and records to third countries or international organisations outside the European Economic Area.
The Data Controller processes the data in a closed system in accordance with the requirements of the Information Security Policy. The Data Controller shall ensure default and built-in data protection. To this end, the Data Controller shall apply appropriate technical and organisational measures to ensure that:
The Data Controller shall apply reasonable physical, technical and organisational security measures to protect the Data Subject's data, in particular against accidental, unauthorised or unlawful destruction, loss, alteration, disclosure, use, access or processing. The Data Controller shall immediately notify the Data Subject of any known unauthorised access to or use of personal data which is known to be of high risk to the Data Subject. The Data Controller shall, where it is necessary to transmit the Data Subject's data, ensure adequate protection of the data transmitted, for example by encrypting the data file. The Controller shall be fully responsible for the processing of the Data Subject's data carried out by third parties. The Data Controller shall also ensure that the Data Subject's data are protected against destruction or loss by appropriate and regular backups.
The legislation governing the processing carried out by the Data Controller:
You may request information about the processing of your personal data, request the rectification, modification or integration of your personal data processed by us, object to the processing of your data and request the erasure or blocking of your data (except for mandatory processing), seek judicial remedies, lodge a complaint with a supervisory authority or initiate proceedings (https://naih.hu/panaszugyintezes-rendje.html)
Supervisory Authority: National Authority for Data Protection and Freedom of Information
Head office: 1055 Budapest, Falk Miksa utca 9-11.
Postal address: 1363 Budapest, Pf.:9
Phone: +36 (1) 391-1400, E-mail: ugyfelszolgalat@naih.hu
Zalakaros, 1 October 2022.
