Privacy Policy

Privacy Policy

1. Purpose, Scope and Applicable Legislation of the Privacy Notice

The purpose of this Privacy Notice is to set out the data protection and data processing principles applied by Hotelbox Hungary Kft., as well as the organisation’s data protection and data processing policy, which the organisation, as the data controller, recognises as binding upon itself.

When drafting the provisions of this Privacy Notice, the organisation has paid particular attention to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council (“General Data Protection Regulation” or “GDPR”), Act CXII of 2011 on Informational Self-Determination and Freedom of Information (“Privacy Act”), Act V of 2013 on the Civil Code (“Civil Code”), and Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Economic Advertising Activities (“Advertising Act”).
The scope of this Privacy Notice extends to the processing of personal data in connection with the websites available at https://bestcover.hu, https://en.bestcover.hu/ and https://healthinsurance.hu (hereinafter collectively referred to as the “Website”). This Privacy Notice shall remain in effect until withdrawn.

The purpose of this Privacy Notice is to harmonise the provisions of the organisation’s other internal policies concerning data processing activities in order to protect the fundamental rights and freedoms of natural persons and to ensure the proper processing of personal data.
Another important purpose of issuing this Privacy Notice is to ensure that, by becoming familiar with and complying with its provisions, the organisation is able to process the personal data of natural persons lawfully.

2. The Data Controller

Name: Hotelbox Hungary Kft.
Registered office: 1134 Budapest, Pattantyús utca 9. 1/4
Telephone: +36302112770
E-mail: zoltan.bursits@bestcover.hu
Data Protection Officer: Bursits Zoltán Levente
The Data Controller is an organisation and business entity registered in Hungary.

3. Key Terms and Definitions

• The GDPR (General Data Protection Regulation) is the European Union’s new General Data Protection Regulation.
• Data Controller: A natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the Data Controller or the specific criteria applicable to its designation may also be determined by Union or Member State law.
• Data Processing: Any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• Data Processor: A natural or legal person, public authority, agency or other body that processes personal data on behalf of the Data Controller.
• Personal Data: Any information relating to an identified or identifiable natural person (the “Data Subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Third Party: A natural or legal person, public authority, agency or other body other than the Data Subject, the Data Controller, the Data Processor, or persons who, under the direct authority of the Data Controller or Data Processor, are authorised to process personal data.
• Consent of the Data Subject: Any freely given, specific, informed and unambiguous indication of the Data Subject’s wishes by which they, by means of a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.
• Restriction of Processing: The marking of stored personal data with the aim of limiting their processing in the future.
• Data Erasure: Rendering data unrecognisable in such a way that its restoration is no longer possible.
• Data Breach: A breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to personal data transmitted, stored or otherwise processed.

4. Data Processing Principles

Personal Data:

• Processing: Personal data must be processed lawfully and fairly and in a transparent manner in relation to the Data Subject (“lawfulness, fairness and transparency”).
• Collection: Personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. Further processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes shall not be considered incompatible with the original purposes in accordance with Article 89(1) (“purpose limitation”).
• Adequacy and Data Minimisation: Personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”).
• Accuracy: Personal data must be accurate and, where necessary, kept up to date. Every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (“accuracy”).
• Storage Limitation: Personal data must be kept in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which the personal data are processed. Personal data may be stored for longer periods only insofar as the personal data will be processed for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1), subject to the implementation of appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of Data Subjects (“storage limitation”).
• Integrity and Confidentiality: Personal data must be processed in a manner that ensures appropriate security through the use of appropriate technical or organisational measures, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage (“integrity and confidentiality”).

The Data Controller shall be responsible for compliance with the above requirements and shall also be able to demonstrate such compliance (“accountability”).

5. Purpose of Data Processing

The Data Controller processes personal data exclusively for specified purposes. The collection and processing of data shall be carried out fairly and lawfully. The Data Controller shall endeavour to process only such personal data as is essential for and suitable for achieving the purpose of the Data Processing. Personal data may only be processed to the extent and for the period necessary to achieve the purpose.

6. Scope of the Data Processed

CONTACT
Purpose of Data Processing: Contact, maintaining contact, providing information, and requesting information.
Legal Basis for Data Processing: The voluntary consent of the Data Subject, Article 6(1)(a) of the GDPR.
Scope of Data Processed: Name (identification), e-mail address (contact), telephone number (contact).
Data Erasure Period: 2 years from the date of the last contact.
Anyone may visit the Data Controller’s website without having to provide any personal data beyond the data processing that is technically carried out automatically.
The deletion or modification of personal data may be requested in the following ways:

• By post: 1134 Budapest, Pattantyús utca 9. 1/4
• By e-mail at zoltan.bursits@bestcover.hu

7. Method of Data Processing

The Data Controller stores the Data Subject’s data on its own servers and temporarily on the Data Controller’s computers. Only the Data Controller is authorised to process the personal data of the Data Subjects.

The provision of data is voluntary in all cases, meaning that the Data Subject is free to decide whether to provide the requested personal data. Where the Data Subject gives their consent, the Data Controller shall process the data in accordance with the applicable legislation and within the limits of the Data Subject’s consent.
In order to prevent unauthorised use and misuse of the personal data processed, the Data Controller implements extensive technical and operational security measures. Our security procedures are regularly reviewed and developed in line with technological advancements.

8. Processing of Technical Data and Cookies

As natural persons may be associated with online identifiers provided by the devices, applications, tools and protocols they use, such as IP addresses and cookie identifiers, these data may, when combined with other information, be used to create profiles of natural persons and to identify the respective individual.

Cookies are also capable of remembering settings, so that users do not have to enter them again when navigating to a new page; they remember previously entered data, eliminating the need to enter it again; they analyse the use of the website so that, based on the information obtained, improvements can be implemented to ensure that the website operates as closely as possible to the user’s expectations, enabling users to easily find the information they are looking for; and they monitor the effectiveness of our advertisements.
If the Data Controller uses external web services to display various content on the Website, this may result in the storage of certain cookies that are not controlled by the Data Controller. Therefore, the Data Controller has no control over what data these websites or external domains collect. Information about these cookies is provided in the policies applicable to the respective service. Users may configure their web browser to accept all cookies, reject all cookies, or notify them when a cookie is being stored on their device. The relevant settings can generally be found under the “Options” or “Settings” menu of the browser. The detailed information available on the English-language website www.aboutcookies.org can also assist users with configuring cookie settings in different browsers.

Cookies Used by the Website:

• Session Cookies: These are essential for navigating our website, enabling key website functions, and accessing protected content. These cookies store the information required to complete forms and, in some cases, the language selected by you. They do not collect information that could be used to identify you, used for marketing purposes, or remember which other websites you have visited. These cookies are automatically deleted and the session is terminated when you close the website.
• Functional Cookies: These cookies detect which device you used to access our website in order to improve your user experience and remember your previous choices (such as your username, password, selected language, region, whether you were logged in during a previous session, and any changes you made to the text size, font, or other customisable elements of the website), allowing us to provide you with better and more personalised functionality. These cookies do not track your activity on other websites and are not used to send you advertisements on other websites.
• Google Analytics Cookies: Google Analytics is an analytics tool provided by Google that helps website and application owners gain a better understanding of how visitors use their websites and applications. The service may use cookies to collect information and generate statistical reports on website usage without personally identifying visitors to Google. The main cookie used by Google Analytics is the “__ga” cookie. In addition to generating reports based on website usage statistics, Google Analytics may also be used to display more relevant advertisements on Google products (such as Google Search) and across the Internet.

9. Data Transfer

The Data Controller shall only transfer personal data to a third party if the Data Subject has given their explicit consent, having been informed of the scope of the data to be transferred and the recipient of the data, or if the transfer of data is authorised by law. The Data Controller shall document all data transfers in every case and maintain a record of such data transfers.

10. Data Processing

The Data Controller is entitled to engage Data Processors for the performance of its activities. Data Processors shall not make independent decisions and shall only be authorised to act in accordance with the agreement concluded with the Data Controller and the instructions received. The Data Controller shall monitor the activities of the Data Processors. Data Processors may engage further Data Processors only with the consent of the Data Controller.

Data Processors Engaged by the Data Controller:

DATA PROCESSING ACTIVITIES RELATED TO WEB HOSTING SERVICES
Name of the Data Processor: ELIN.hu Informatikai Szolgáltató és Tanácsadó Kft.
Registered office of the Data Processor: 9024 Győr, Déry T utca 11. 2nd floor, 4.
Telephone number of the Data Processor: +36 30 2222 444
E-mail address of the Data Processor: info@elin.hu
Based on a written agreement concluded with the Data Controller, the Data Processor assists with the provision of web hosting services for the Website. In the course of this activity, the Data Processor records the personal data of customers stored in the Website’s database in its information technology system.
Data Processing Period and Data Erasure Deadline: Until the termination of the agreement between the Data Controller and the web hosting provider, or until the Data Subject submits a request for erasure to the web hosting provider.

–

DATA PROCESSING ACTIVITIES RELATED TO MARKETING AND SOCIAL MEDIA COMMUNICATION
Name of the Data Processor: Facebook Ireland Ltd.
Registered office of the Data Processor: 4 Grand Canal Square, Dublin, Ireland
E-mail address of the Data Processor: support@facebook.com
By default, plugins are disabled on the Website. Plugins are only enabled if the data subject clicks the dedicated button (Marketing cookies). By enabling the plugin, the data subject establishes a connection with the social network and consents to the transfer of their data to Facebook.

–

DATA PROCESSING ACTIVITIES RELATED TO GOOGLE ANALYTICS AGGREGATED DATA ANALYSIS
Name of data processor: Google, Mountain View, California, United States
Address of data processor: Ireland, Dublin, 4 Barrow Street
Data processor email address: –
Based on the contract concluded with the Data Controller, the Data Processor uses the Data Processor's service named Google Analytics, which helps both the Data Controller and the Data Processor gain a more accurate picture of their visitors' activities.

11. Third-party service providers

In operating the Website, the Data Controller uses third-party service providers with whom the Data Controller cooperates.
Regarding the personal data processed in the systems of Third-Party Service Providers, the provisions set forth in the third-party service providers' own privacy policies shall apply. The Data Controller makes every effort to ensure that the third-party service provider processes the personal data transferred to it in accordance with the law and uses it exclusively for the purposes specified by the User or set out below in this notice.

The Data Controller informs Users about data transfers to third-party service providers within the framework of this Notice.

Third-party service providers:

• Facebook Ireland Limited, 4 Grand Canal Square, Dublin, Ireland (marketing, social media communication, Facebook)
• Google, Mountain View, California, United States (Google Analytics aggregated data analysis)

12. Data security, access to data

The Data Controller ensures the security of the data, takes the technical and organizational measures, and establishes the procedural rules necessary to enforce the applicable laws, data protection, and confidentiality regulations. The Data Controller protects the data through appropriate measures against unauthorized access, alteration, transfer, disclosure, deletion, or destruction, as well as against accidental destruction and damage, and inaccessibility resulting from changes in the technology used.
The Data Controller maintains records of the data it processes in accordance with applicable laws, ensuring that the data can only be accessed by employees and other persons acting within the scope of the Data Controller's operations (data processors) who need access to fulfill their job duties or tasks. Within the employee organization, data can only be accessed under logging conditions. The Data Controller's employees perform individual searches or individual operations on the data only upon the User's request, or if necessary for the provision of the service.

13. Duration of data processing

The Data Controller shall delete personal data if

• its processing is unlawful: If it transpires that the processing of the data is unlawful, the Data Controller shall execute the deletion without delay.
• the data subject requests it (with the exception of data processing based on statutory provisions): The data subject may request the deletion of data processed based on their voluntary consent. In this case, the Data Controller deletes the data.
• the data is incomplete or inaccurate – and this condition cannot be lawfully rectified –, provided that deletion is not excluded by law.
• the purpose of the data processing has ceased, or the statutory period for storing the data has expired. Since the Data Controller provides continuous services to the data subject, the relationship between the parties is not subject to a time limit. Based on all this – in the absence of a request from the data subject – the Data Controller processes the data for as long as the relationship between the Data Controller and the data subject exists, and as long as the Data Controller can provide services to the data subject. The Data Controller shall delete all other data if it is evident that the data will not be used in the future, i.e., the purpose of the data processing has ceased.
• it is ordered by a court or the National Authority for Data Protection and Freedom of Information: If a court or the National Authority for Data Protection and Freedom of Information orders the deletion of the data in a legally binding manner, the Data Controller shall execute the deletion. Instead of deletion, the Data Controller shall – while informing the data subject – block the personal data if the data subject requests this, or if based on the information available to it, it can be assumed that deletion would prejudice the legitimate interests of the data subject. Personal data blocked in this manner may only be processed for as long as the data processing purpose that excluded the deletion of the personal data exists. The Data Controller marks the personal data it processes if the data subject disputes its correctness or accuracy, but the incorrectness or inaccuracy of the disputed personal data cannot be clearly established. In the case of data processing ordered by law, the deletion of data shall be governed by the provisions of the law. In the event of deletion, the Data Controller renders the data unidentifiable. If prescribed by law, the Data Controller shall destroy the data carrier containing the personal data.

14. Customer Relations

• Should any question arise or should the data subject experience any issue while using the Data Controller's services, they may contact the Data Controller using the methods specified on the website (telephone, email, social media sites, etc.).
• The Data Controller deletes incoming emails, messages, and data provided via telephone, Facebook, etc., together with the inquirer's name and email address, as well as any other voluntarily provided personal data, after a maximum period of 2 years from the date of communication.
• For data processing operations not listed in this notice, information will be provided at the time the data is collected.
• In the event of an exceptional request by an authority, or a request by other bodies based on statutory authorization, the Service Provider is obliged to provide information, disclose or transfer data, and make documents available.
• In such cases, the Service Provider shall disclose personal data to the requesting party – provided that the exact purpose and the scope of data have been specified – only to the extent and in the amount strictly necessary to achieve the purpose of the request.

15. Rights related to data processing

Right to request information: Any person may request information through the provided contact details regarding what data of theirs the organization processes, on what legal basis, for what data processing purpose, from what source, and for how long. Upon their request, information must be sent without delay, but no later than within 30 days, to the contact details provided.
Right to rectification: Any person may request the modification of any of their data through the provided contact details. Action must be taken on this request without delay, but no later than within 30 days, and information must be sent to the contact details provided.
Right to erasure (right to be forgotten): Any person may request the erasure of their data through the provided contact details. Upon their request, this must be done without delay, but no later than within 30 days, and information must be sent to the contact details provided.
Data that must be stored due to a legal, statutory, or contractual obligation in order to preserve commercial records shall be blocked instead of erased to prevent its use for other purposes.
Right to restriction of processing (blocking): Any person may request the blocking of their data through the provided contact details. The blocking shall last for as long as the specified reason makes the storage of the data necessary. Upon request, this must be done without delay, but no later than within 30 days, and information must be sent to the contact details provided.
Right to object: Any person may object to the processing of their data through the provided contact details. The objection must be examined within the shortest possible timeframe from the submission of the request, but no later than within 15 days, a decision must be made regarding its merits, and information on the decision must be sent to the contact details provided.

16. Legal enforcement options related to data processing

National Authority for Data Protection and Freedom of Information
Postal address: 1530 Budapest, Pf.: 5.
Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c
Telephone: +36 (1) 391-1400
Fax: +36 (1) 391-1410
Email: ugyfelszolgalat (at) naih.hu
Web: https://naih.hu

Dated: April 15, 2020