Company "Éva Földesi" (tax-registered individual)
Fullhouse Apartment House
Privacy Policy
Effective: 2019.01.01.

1.
During its activities, "Éva Földesi - tax-registered private individual" (hereinafter referred to as the Data Controller) pays particular attention to the protection of personal data, compliance with mandatory legal provisions, and secure and fair data management.

Data Controller's details: Company name: "Éva Földesi - Fullhouse Apartment House "
Individual with tax ID number”.
Registered office: 8621 Zamárdi Rétföldi Street 46/B.
Tax number: 75902203-1-34
NTAK registration number: MA23079655

Based on the notification to the National Data Protection and Freedom of Information Authority, the data protection registration identification number of the Data Controller is: “notification in progress”.
The Data Controller will always process the personal data provided to it in compliance with the applicable Hungarian and European laws and ethical requirements, and will always take the technical and organizational measures necessary for proper and secure data management.
This policy has been prepared taking into account the following applicable laws:

- Act CXIX of 2011. name and address information for the purpose of research and direct marketing
on the management of address data

- Act CVIII of 2011 on electronic commerce services and information services
on certain issues of social services

- Act XLVIII of 2011 on the basic conditions and certain limitations of economic advertising activities

- Act CXII of 2011 on the right to informational self-determination and freedom of information

- Regulation 2016/679/EU (27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation 95/46/EC, the Data Controller undertakes to unilaterally comply with this policy and requests - in a notice available on its website - that its customers also accept the provisions of the policy. The Data Controller reserves the right to change its data protection policy. If the policy is modified, it will publicly publish its updated text.
2.
In our policy, data protection terms have the following meanings:
- data file: the set of data managed in a register;
- data processor: the natural or legal person, or an organization without legal personality, who processes data on the basis of a contract - including a contract concluded on the basis of a legal provision;
- data controller: the body performing public tasks that produced the data of public interest that must be published electronically, or in the course of whose operations this data was generated;
- data processing: any operation or set of operations performed on data, regardless of the procedure used, including in particular collection, recording, recording, organization, storage, alteration, use, retrieval, transmission, disclosure, alignment or combination, blocking, erasure and destruction, as well as preventing further use of the data, taking photographs, audio or video recordings and recording physical characteristics suitable for identifying a person (e.g. fingerprints or palm prints, DNA samples, iris images);
- data controller: the natural or legal person or organization without legal personality who, alone or jointly with others, determines the purposes of data processing, makes and implements decisions relating to data processing (including the means used), or has them implemented by the data processor;
- data provider: the body performing a public task which - if the data controller does not publish the data itself - publishes the data provided to it by the data controller on a website;
- data marking: providing data with an identification mark for the purpose of distinguishing it;
- data transfer: making data available to a specific third party;
- data deletion: making data unrecognizable in such a way that its recovery is no longer possible;
- data protection incident: unlawful handling or processing of personal data, in particular unauthorized access, alteration, transmission, disclosure, deletion or destruction, as well as accidental destruction and damage.
- data blocking: providing the data with an identification mark in order to limit its further processing permanently or for a specific period of time;
- criminal personal data: personal data relating to the criminal offence or criminal proceedings, generated during or prior to criminal proceedings in connection with the criminal offence or criminal proceedings, by the bodies authorised to conduct criminal proceedings or to detect criminal offences, as well as by the penal organisation, and relating to the data subject and criminal record;
- EEA state: a Member State of the European Union and another state party to the Agreement on the European Economic Area, as well as a state whose citizen enjoys the same legal status as a citizen of a state party to the Agreement on the European Economic Area based on an international treaty concluded between the European Union and its Member States and a state not party to the Agreement on the European Economic Area;
- data subject: any natural person identified or identifiable - directly or indirectly - on the basis of specific personal data;
- third country: any state that is not an EEA state;
- third party: a natural or legal person or an organization without legal personality who is not the same as the data subject, the data controller or the data processor;
- consent: a voluntary and definite indication of the data subject's will, based on adequate information, by which he or she gives his or her unambiguous consent to the processing of personal data relating to him or her, in whole or in part;
- binding organizational regulation: internal data protection regulations adopted by a data controller or group of data controllers operating in several countries, including at least one EEA state, and approved by the National Authority for Data Protection and Freedom of Information (hereinafter referred to as the Authority), binding on the data controller or group of data controllers, which ensures the protection of personal data in the event of data transfer to a third country through a unilateral commitment by the data controller or group of data controllers;
- data public in the public interest: all data not falling under the concept of public interest data, the disclosure, accessibility or accessibility of which is ordered by law in the public interest;
- special data:
3.
Personal data relating to racial origin, nationality, political opinion or party affiliation, religious or other ideological beliefs, membership of an interest-representative organization, sexual life,
4.
Personal data relating to health status, pathological addiction, and criminal personal data;
- disclosure: making data available to anyone;
- personal data: data that can be linked to the data subject - in particular the name, identification number and one or more specific physical, physiological, mental, economic, cultural or social characteristics of the data subject - and any conclusion that can be drawn from the data concerning the data subject;
- objection: a statement by the data subject objecting to the processing of his or her personal data and requesting the termination of the processing or the deletion of the processed data;
5.
Personal data relating to racial origin, nationality, political opinion or party affiliation, religious or other ideological beliefs, membership of an interest-representative organization, sexual life,
6.
Personal data relating to racial origin, nationality, political opinion or party affiliation, religious or other ideological beliefs, membership of an interest-representative organization, sexual life,
-data processing: the performance of technical tasks related to data processing operations, regardless of the method and means used to perform the operations and the place of application, provided that the technical task is performed on the data;
-data destruction: complete physical destruction of the data medium containing the data;
7.
Personal data relating to health status, pathological addiction, and criminal personal data.
8.
Personal data relating to health status, pathological addiction, and criminal personal data;
-public interest data: information or knowledge recorded in any way or form, regardless of whether it is in the possession of a body or person performing a state or local government task or other public task specified by law and relating to its activities or arising in connection with the performance of its public task, and not falling under the concept of personal data
the method of processing, its independent or collective nature, in particular data relating to competence, jurisdiction, organizational structure, professional activity, its evaluation including its effectiveness, the types of data held and the laws governing the operation, as well as management and concluded contracts;
9.
Personal data may only be processed for specific purposes, for the exercise of rights and the fulfilment of obligations. Data processing must comply with the purpose of data processing at all stages, and the collection and processing of data must be fair and lawful. Only personal data that is essential for the achievement of the purpose of data processing and suitable for achieving the purpose may be processed. Personal data may only be processed to the extent and for the period necessary for the achievement of the purpose. Personal data shall retain this quality during data processing as long as its relationship with the data subject can be restored. The relationship with the data subject can be restored if the data controller has the technical conditions necessary for the restoration. During data processing, the accuracy, completeness and - if necessary in view of the purpose of data processing - up-to-dateness of the data must be ensured, and the data subject can only be identified for the period necessary for the purpose of data processing. The processing of personal data shall be considered fair and lawful if, in order to ensure the freedom of expression of the data subject, the person wishing to obtain the data subject's opinion visits the data subject at his or her place of residence or residence, provided that the data subject's personal data are processed in accordance with the provisions of this Act and the personal inquiry is not for commercial purposes. Personal inquiries may not take place on a holiday under the Labour Code. Personal data may be processed if the data subject consents to it or if it is ordered by law or - on the basis of the authorisation of the law, within the scope specified therein - by a decree of a local government for a purpose based on public interest (mandatory data processing). Personal data may only be processed for a specific purpose, in order to exercise a right and fulfil an obligation. Data processing must comply with this purpose at all stages. Only personal data may be processed that is essential for the achievement of the purpose of data processing, is suitable for achieving the purpose, and is only processed to the extent and for the period necessary for achieving the purpose. Personal data may be transferred and different data processing operations may be linked if the data subject has consented to it or if the law permits it, and if the conditions for data processing are met for each personal data item. Personal data may be transferred from the country – regardless of the data carrier or the method of data transfer – to a data controller or data processor in a third country if the data subject has expressly consented to it or if it is permitted by law and an adequate level of protection of personal data is ensured during the handling or processing of the transferred data in the third country. In the case of mandatory data processing, the purpose and conditions of data processing, the scope and accessibility of the data to be processed, the duration of data processing and the identity of the data controller are determined by the law or local government decree ordering the data processing. A law may order the disclosure of personal data in the public interest – by expressly specifying the scope of the data. In all other cases, the consent of the data subject is required for disclosure, or in the case of sensitive data, written consent. In case of doubt, it shall be presumed that the data subject has not given his/her consent. The data subject's consent shall be deemed to have been given in respect of the data communicated by the data subject during his/her public appearance or transmitted for the purpose of disclosure. In proceedings initiated at the request of the data subject, his/her consent to the processing of the necessary data shall be presumed. The data subject's attention shall be drawn to this fact. The data subject may also give his/her consent within the framework of a written contract concluded with the Data Controller for the purpose of fulfilling the provisions of the contract. In this case, the contract shall contain all information that the data subject needs to know in terms of the processing of personal data, in particular the definition of the data to be processed, the duration of the data processing, the purpose of use, the transmission of the data, the use of a data processor. The contract shall clearly state that the data subject, by signing it, consents to the processing of his/her data as specified in the contract. The right to the protection of personal data and the personality rights of the data subject - unless otherwise provided by law - may not be violated by other interests related to data processing, including the disclosure of data of public interest.
10.
The Data Controller, in the course of its activities, always processes personal data based on law or voluntary consent. In some cases, data processing, in the absence of consent, is based on other legal grounds or on Section 6 of Act CXII of 2011. The Data Controller does not use the cooperation and services of the following Data Processors for its activities. In the case of data of website visitors, the Data Controller does not record the user's IP address or other personal data when visiting the websites it operates. The html code of the websites operated by the Data Controller may contain links to and from an independent external server for the purpose of web analytics measurements. The measurement also includes tracking conversions. The web analytics service provider does not process personal data, but only browsing-related data that is not suitable for identifying individuals. Description of the data protection technical solution (e.g.): the Data Controller runs so-called remarketing advertisements through the advertising systems of Facebook and Google AdWords. These service providers may collect or receive data from the Data Controller's website and other Internet locations using cookies, web beacons and similar technologies. They use this data to provide measurement services and target advertisements: these may appear on additional websites in the Facebook and Google partner network. Remarketing lists do not contain the visitor's personal data and are not suitable for personal identification. The user can delete the use of cookies from their own computer or prohibit their use in their browser. These options depend on the browser, but are typically available in the Settings / Privacy menu item. Further information about the privacy policies of Google and Facebook can be found at the following addresses: http://www.google.com/privacy.html and https://www.facebook.com/about/privacy/
Newsletter - The Data Controller delivers online newsletters containing news, updates and business offers and direct marketing messages electronically to subscribers (also known as VIP members) of the website it operates, usually once a month, but no more than twice a week.
11.
There are 6 cameras operating in the area of the accommodation operated by the Fullhouse Apartment House – which record and store images – for the personal and property safety of the Guests. Camera surveillance is indicated by the pictogram and warning text indicating this. The purpose of camera surveillance is property protection, i.e. the protection of assets representing significant values, and the personal values of the Guests, given that the detection of violations, the apprehension of the perpetrator, the prevention of these illegal acts is not possible otherwise, and their proof cannot be achieved by any other method. The legal basis for this data processing is your voluntary consent. If you enter the monitored area of the Fullhouse Apartment House despite the warning posted, your consent is deemed to be given for the recording of images. Please do not enter if you do not wish to consent to this. The camera system operates on a closed-circuit network, 24/7, i.e. continuously, and the storage period of the recorded footage is 48 hours. You can request more information about data management related to the camera system when booking your accommodation.