PRIVACY NOTICE
(registration to participate in the loyalty programme)

1. The controller’s name, registered office and representative

• Name: Kolping Hotel Kft.
• Registered office: H-8394 Alsópáhok, Fő utca 120
• Official representative: Csaba Baldauf, CEO
• Contact person for data protection issues: Judit Nyírő, Deputy Director of Operations

2. Data Protection Officer

• Dr. Morvay Boldizsár - dpo@kolping.hotel.hu

3. The data processed

To successfully register, the following information must be provided:

• name
• email address

Additional information that can be voluntarily provided during registration: (registration will also be completed without providing this information)

• date of birth
• names and dates of birth of family members
• phone number
• nationality

During the registration process, in exchange for loyalty points, friends can be referred by entering their name and email address. Friends’ data will not be processed, they will only receive an automatic information letter about the possibility of registration.

Other personal data processed in the loyalty programme:

• details of hotel stays after registration in the loyalty programme

4. Purpose of the data processing

The voluntary provision of data serves the purpose of participating in the loyalty programme, sending higher level, more personalised offers to regulars, providing services, taking advantage of the benefits of the loyalty programme and receiving discounts.

• name, email address required for registration
• address, date of birth, names and dates of birth of family members, nationality required to facilitate check-in
• the phone number is for contact purposes
• the data of subsequent stays in the hotel are of interest for the additional services and discounts available in the regular guest programme.

5. Legal basis for the data processing

• the data subject’s consent for all data – Article 6(1)(a) of the GDPR (participation in the loyalty programme is voluntary – subject to prior registration)

6. Legal consequences if data are not supplied

• the data subject is unable to use the services of the controller, so no data processing takes place.

7. Transfer of data

a.) data are transferred only to the data processor company operating the online quote request and booking system; name of data processor: Flexys Kft., registered office: H-1037 Budapest, Máramaros utca 23/a

b.) the e-mail address will be transferred within the European Union in encrypted (SHA-256 hash algorithm), non-reversible form for statistical and analytical purposes and for personalised advertising to the following company:
– Google Ireland Limited (address: Google Building Gordon House, Barrow St, Dublin 4, Ireland)

c.) the e-mail address will be transferred to a third country, to the following company in encrypted (SHA-256 hash algorithm), non-reversible form for statistical and analytical purposes and for personalised advertising:
– META Inc (1601 WILLOW ROAD MENLO PARK, CA 94025-USA)
– Microsoft Inc (One Microsoft Way. Redmond, Washington 98052-6399-USA)

8. Legal basis of the data transfer

– with regard to the transfer of data under 7.a: performance of contract
– with regard to the transfer of data under 7.b.c: the data subject’s consent

9. Duration of the processing of personal data

• until withdrawal (until the date of leaving the loyalty programme)

10. Information on data subject rights

Data subjects have the right to

• obtain from the controller confirmation as to whether or not personal data concerning them are being processed, and, where that is the case, access to the personal data.
• obtain from the controller without undue delay the rectification of inaccurate personal data concerning them.
• obtain from the controller the erasure of personal data concerning them without undue delay and the controller shall have the obligation to erase personal data without undue delay.
• obtain from the controller restriction of processing where one of the following applies
  • the accuracy of the personal data is contested by the data subject /for a period enabling the controller to verify the accuracy of the personal data/,
  • the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead,
  • the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims,
  • the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.
• receive their personal data, provided by them to the controller, in a structured, commonly used format, and transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the data processing is based on voluntary consent or contract, and is carried out by automated means.
• where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning them for such marketing, which includes profiling to the extent that it is related to such direct marketing.
• not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

11. Information on profiling and automated decision-making

• there is no profiling and automated decision-making

12. Data storage, data security

The controller and the data processing entity store the data on their own information technology equipment, which are located at the registered office of the former and at a leased server farm of the latter. The controller and the data processor will select and operate the information technology equipment so that the data processed are available to the authorised persons, the authenticity and authentication of the data is guaranteed, their integrity can be proven, and they are protected against unauthorised access. The data are protected against unauthorised access, alteration, transfer, disclosure, erasure, intended or unintended destruction, damage, and unavailability resulting from any changes in the technology; so that, taking into account the state of the art, the controller shall ensure the security of data processing by technical and organisational measures at a level appropriate to the risks arising in relation to the data processing.

13. Right to turn to the authorities

Data subjects may take the controller to court if their rights have been breached. Lawsuits will be adjudicated by the Regional Court (Zalaegerszeg Regional Court contact information: H-8900 Zalaegerszeg, Várkör u. 2). The data subject may choose whether to bring a lawsuit before a regional court with competence at the data subject’s permanent or temporary place of residence. In such matters, the court will expedite its procedures.
Legal remedy is available and complaints may be filed with the Hungarian National Authority for Data Protection and Freedom of Information: Name: Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information) Address: H-1055 Budapest, Falk Miksa utca 9-11 Postal address: H-1363 Budapest, Pf.: 5. Phone: +36 (1) 391-1400, Fax: +36 (1) 391-1410; Email: ugyfelszolgalat@naih.hu; Website: http://www.naih.hu

14. Link to the Privacy Policy

The controller’s Privacy Policy is available at https://kolping.hotel.hu/en/privacy-policy.