BALATONTOURIST Camping Kft.

DATA PROTECTION AND PRIVACY POLICY

I. Introduction

Name: BALATONTOURIST [BALATONTOURIST Camping Kft.]
Cg.: 19-09-517400
Registered office: 8900 Veszprém, Levendula u. 1., Hungary
Location of actual administration: H-8200 Veszprém, Levendula u. 1., Hungary
Represented by: Gábor Zoltán Nagy, Chief Executive Officer
Tel.: +36 (88) 544-400
Fax: +36 (88) 544-401
E-mail: info@balatontourist.hu

– hereinafter referred to as: “Controller” – shall act in accordance with the following privacy policy (hereinafter referred to as: “Policy”) in the course of its data controlling activities. The current version of the data protection policy as in force from time to time is available at the www.balatontourist.hu website.

The Controller reserves the right to modify the Policy in order to adjust it to the legal background and other internal policies that may change over time.

The scope of the Policy shall apply to franchise and other contractual partners of the Controller (hereinafter referred to as: “contractual partner”).

II. The objective of the policy

1. In relation to the contents published at the www.balatontourist.hu website (hereinafter referred to as: “website”), the Controller deems it greatly important, and it is committed to protect the personal data provided by the visitors of the website and to respect their right of informational self-determination. In this regard, the Controller, fully complying with the applicable laws in force, shall contribute to creating the opportunity for the visitors to surf the Internet safely.

2. The www.nethotelbooking.net portal, which is directly available from the website under the “online booking” menu item, shall handle the personal data of the visitors confidentially, in accordance with the requirements of the legal regulations in force, and shall ensure the safety of such data, shall take technical and organisational measures, and shall develop procedural rules in order to fully comply with the principles of data protection.

3. Thus, the objective of this policy is to fully provide the rules of the control of all facts, information and data (hereinafter collectively referred to as: personal data) arising in relation to the scope of operation and publication of the www.balatontourist.hu website (hereinafter referred to as: the “website”), the user, the contractual partners being in a franchise or other contractual relationship with the Controller (hereinafter referred to as: “contractual partners), and published on the website that fall under the scope of Act CXII of 2011 on Informational Self-determination and Freedom of Information (hereinafter referred to as: the “Privacy Act”) in accordance with Paragraph (1) of Section 2 thereof, and to ensure the protection of such data against being acquired or used by any unauthorised third parties or being published.

4. The Controller shall ensure and take all information technology related measures and any other measures helping safe data control in relation to data storage and processing in order to protect the data.

5. This policy was developed in excess of the provisions of the Privacy Act, with regard to and in line with online ordering, online booking, and the online payment system, and in line with the disclosure of any other data referred to in Section 1 related to the operation of the website and the camera surveillance system.

III. Fundamental definitions

• data subject: any natural person identified or directly or indirectly identifiable on the basis of personal data;

• personal data: data relating to the data subject, in particular the name and identification number of the data subject, as well as one or more factors specific to his physical, physiological, mental, economic, cultural or social identity as well as conclusions drawn from the data in regard to the data subject;

• consent: any freely given specific and informed indication of the will of the data subject, by which he signifies his agreement to personal data relating to him being controlled fully or to the extent of specific operations;

• controller: natural or legal person, or organisation without legal personality which alone or jointly with others determines the purposes and means of the control of the data; makes and executes decisions concerning data control (including the means used) or contracts a data processor to execute it;

• data control: any operation or the totality of operations performed on the data, regardless of the procedure applied; in particular, data collecting, recording, registration, classifying, storing, modifying, using, querying, transferring, disclosing, synchronising or connecting, blocking, deleting and destructing, as well as preventing the further use of the data, taking photos, making audio or visual recordings, as well as registering physical characteristics suitable for personal identification;

• data transfer: ensuring access to the data for a third party;

• data processing: undertaking technical tasks in connection with data control operations, regardless of the method and means used for executing the operations, as well as the place of use, provided that the technical task is performed on the data;

• data set: total data controlled in a single file;

• third party: any natural or legal person, or organisation without legal personality other than the data subject, the data controller or the data processor;

IV. The Controller

1. The Controller is the operator of the website (hereinafter referred to as: the “Operator”), who is

Name: BALATONTOURIST Camping Kft.
Company registration number: 19-09-517400
Registered office: H-8200 Veszprém, Levendula utca 1., Hungary
Represented by: Gábor Zoltán Nagy, Chief Executive Officer
Tel.: +36 (88) 544-400
Fax: +36 (88) 544-401
E-mail: booking@balatontourist.hu

2. The Controller shall ensure that the data subject can get to know all of the provisions included in this policy. Moreover, the Controller shall also ensure that this policy will be accessible to the data subject.

3. The Controller shall not verify the personal data provided to it and excludes liability for the correctness thereof.

4. The Controller shall do all that may be expected of the Controller to protect the personal data controlled by it from unauthorised access, modification, publication, deletion, damage, and destruction, and to guarantee the technical conditions necessary in order to do so.

5. The Controller excludes liability for the legality of the data controlling activities of contractual partners being in a legal relationship with the Controller.

V. The principles of data control

1. Personal data may exclusively be controlled for a specific purpose to realize rights and fulfil obligations. Data control must at every stage comply with the objective of the data control; data must be recorded and controlled in a fair and legal manner.

–Principle of purpose limitation–

2. Only personal data essentially needed to satisfy the aim of the control, appropriate for achieving the goal may be controlled. Personal data may only be controlled to the extent and for the time required to achieve the goal.

– Principle of proportionality, necessity –

3. Throughout the data control process, personal data shall be classified as such until its connection with the data subject can be restored. The connection with the data subject can be restored if the data controller has the technical conditions required for restoration at his or her disposal.

4. It has to be ensured during the course of control that the data are accurate, complete and – if required for the data control – updated, and that the data subject is only identifiable for the time required for the data control.

5. In order to protect personal data stored in automated data sets, by applying appropriate safety measures, the Controller shall ensure that accidental or unauthorised destruction, accidental loss, and unauthorised access, modification or dissemination is prevented.

6. The provision of data by the data subject is voluntary. The Controller shall control the personal data with the consent of the data subject.

7. The Controller shall transfer the personal data to third parties, or connect the database controlled by it with another data controller only exceptionally and in case the data subject gives its consent thereto, or if it is permitted by law, and if the conditions of data control are met respecting each and every item of personal data.

8. The Controller shall not transfer personal data to data controllers or data processors in third countries.

VI. The scope of activities and data affected by the data control¹

1. Accommodation ordering:

The scope of controlled data:

Name:*
Post code and city/town:*
Address (street, house no.):*
Telephone:
Fax:
E-mail:*

2. Accommodation booking:

The scope of controlled data:

* Title:
* Last name:
* First name:
Name of company/office:
* Street, house no.:
* City/town:
* Post code:
* Country:
* Tel:
* E-mail address:
* E-mail address again:

3. Online payment:

The scope of controlled data:

Name of card holder
Name of card issuing bank
Number and expiry date (in MM/YY format) of the card
In case of payment by card, if the card has a CVV2 or CVC2 safety code

4. Newsletter subscription:

The scope of controlled data:

* E-mail address

5. Other data controlled in relation to the booking

Date of birth
Nationality
Passport or personal ID card number

6. Filling out the online survey:

The user accepts that following his/her booking and stay at the accommodation, we will send him/her a survey that may be filled out anonymously, wherein he/she can evaluate the accommodation. Filling out the survey shall be completely voluntary, and the data provided therein shall be sent only to the accommodation and shall not be displayed at any public surface. The provision of personal data shall not be necessary for filling out the survey. The purpose of our survey is to improve the standard of quality of the services of the accommodation.

7. Surveillance camera system

In the units listed below, informational notice boards warn the data subjects that a surveillance camera system is in operation for personal safety and property protection purposes.

Aranypart Kemping (8600 Siófok-Szabadifürdő, Szent László u 185., Hungary) (operated by the Controller itself)
Európa Kemping (8226 Alsóörs, Füredi u 1., Hungary) (operated by a contractual partner)
Füred Kemping (8230 Balatonfüred, Széchenyi u 24., Hungary) (operated by the Controller itself)
Strand-Holiday Kemping (8243 Balatonakali, Strand u 2., Hungary) (operated by a contractual partner)
Venus Kemping (8252 Balatonszepezd, Halász u 1., Hungary) (operated by a contractual partner)
Napfény Kemping (8253 Révfülöp, Halász u 5., Hungary) (operated by the Controller itself)
Vadvirág Kemping (8636 Balatonszemes, Lellei u 1-2., Hungary) (operated by the Controller itself)

VII. Storing personal data, information safety

1. Personal Data may be controlled only in line with the activities included in Section VI and in accordance with the purpose of the data control.

2. The purpose of the data control: establishing and keeping in contact with the data subject, registration at the website, data control for the purposes of using related services, management of the database for sending a newsletter, marketing, improvement of the standard of quality of the services in the Controller’s profile, as well as market research and surveying customer habits to this end.

3. The legal grounds for data control: the data subject’s voluntary consent based on the prior provision of information by the Controller.

4. The duration of the data control: as long as the customer relation exists, until the e-mail address of the data subject is deleted at his/her request or until his/her consent to data control is withdrawn.

5. Personal data may be modified or deleted, consent may be withdrawn, and information on the control of personal data may be requested by sending a notice to the booking@balatontourist.hu address, or in relation to the online bookings, by sending a notice to the direct e-mail address of the accommodation provider.

6. The recipient may unsubscribe from the newsletter by using the link at the bottom of the newsletter, in the manner provided therein.

7. Data shall be transferred in case of online bookings, with the consent of the data subject, without a violation of his/her interests, in a confidential manner, and by providing an information technology system (resNweb) completely suitable for this. The Controller shall not transfer, publish, or make the personal data of the data subject available to third parties in any other cases without the data subject’s consent unless it is required by law.

8. The Controller shall provide for the information technology environment applied for the controlling of personal data in the course of the provision of its services in such a manner that

• The Controller shall not connect the personal data provided by the data subject with any other personal data.

• All modifications of the data shall be carried out by indicating the time of modification.

• Erroneous data shall be deleted at the data subject’s request within 24 hours.

• A safety backup shall be made of the data.

9. The Controller shall provide the expected level of protection in the course of its controlling the data – especially the storing, correction and deletion thereof – and in relation to the data subject’s requesting information or raising an objection.

10. Other data of the data subject which are not directly or directly related to him/her and which are unidentifiable – hereinafter referred to as “anonym data” – shall not be considered as personal data.

11. Visitor registration, login, the use of "cookies" and web monitoring:

In the course of the provision of our services, we control anonym data, monitor surfing habits, and monitor and record the use and visits of our website by using cookies, authorised cookies from third parties, and by using web monitoring programs and/or other technological solutions, and we collect such data and control them cumulatively for statistical purposes, in a manner incapable of personally identifying the user.

12. Special rules applying to the operation of the surveillance camera system

    1. The camera system records video footage.

    2. The purpose of data control: personal safety and property protection.

    3. The storing location of the footage: the units specified in Section 7 of the Controller or the contractual partner as operator (hereinafter collectively referred to as: “Operator”).

    4. The legal grounds for data control: the data subject’s voluntary consent based on the Operator’s information displayed in the form of notice boards. Such consent may be granted implicitly by conduct. Such conduct implying consent shall be in particular, the data subject’s entering or staying at units with surveillance camera systems (Section VI.7.)

    5. The Operator must ensure that the data subject’s personal data, especially his/her private secrets and the circumstances of his/her private life shall be protected from disclosure to unauthorised third parties.

    6. An electronic surveillance system must not be used at places where the surveillance can injure human dignity, such as in dressing rooms, showers, bathrooms, and toilets.

    7. The duration of storing the footage: If not used, the recorded video footage must be destroyed or deleted within 15 workdays from its recording at the latest. For the purposes of this section, use (used) shall mean that the recorded video footage or any other personal data is used as evidence in a judicial or other official proceeding.

    8. Anyone whose rights or rightful interests are injured by the video footage or the recording of the personal data of another person may request within 15 workdays, by proving his/her rights or rightful interests, that the data not be destroyed or deleted by its controller.

    9. At the inquiry of a court or another authority, the recorded footage or any other personal data must be sent to the court or the authority without delay. If no inquiry is received within thirty days from the request for the omission of the destruction, the recorded footage and any other personal data must be destroyed or deleted unless the deadline specified in Section 12.8. has not yet expired.

    10. The recorded footage or any other personal data may be disclosed only to the person acting as the Operator’s representative and appointed to handle the footage if it is unavoidable for preventing or stopping an illegal act. The name of the person handling or any other person authorised to learn the recorded footage or personal data, and the reasons and the time of the disclosure of the data shall be recorded in a protocol.

VIII. Legal remedies

1. The data subject may request information on the control of his/her personal data, may request the correction of his/her personal data, and may request the deletion or blocking of his/her personal data, with the exception of mandatory control provided by law, at the e-mail address specified in Section VII.5, and within the scope of individual activities involved by data control, in accordance with the provisions specified with respect thereto.

2. Pursuant to the request of the data subject, the Controller shall provide information on the data controlled by it, as well as the purpose of the control, its legal grounds and duration, the details of the data processor and the activities it undertakes in connection with the control, and provide information on who and for what purpose receive or received the data.

3. The Controller shall correct the personal data if is incorrect, and the Controller shall delete the data if:

a) its control is illegal;

b) it is requested by the data subject;

c) it is incomplete or incorrect – and this cannot be legitimately remedied – on condition that the law does not rule out deletion;

d) the purpose of the control have ceased to exist or the period defined in the relevant legislation for storing the data has expired;

e) it is ordered by the court or the Hungarian National Authority for Data Protection and Freedom of Information.

4. The Controller shall notify the data subject and everyone to whom the data was transferred for control purposes of any correction and deletion. Such notification may be omitted if this does not violate the rightful interest of the data subject with regard to the purpose of the data control.

5. The data subject is entitled to object to the control of his/her personal data if

1. the control (transfer) of personal data is necessary only in order to enforce the rights or rightful interests of the controller or the data recipient, except in the case of mandatory data control;

b) the personal data is used or transferred for direct business solicitation, public opinion surveys or scientific research purposes;

c) exercising the right of objection is otherwise permitted by law.

6. The Controller shall examine the objection, by simultaneously suspending the data control, within the shortest time following the submission of the request, but no later than within 15 workdays, and notify the applicant of the results of such examination in writing. If the applicant’s objection is justified, the Controller shall suspend the control process – including data entry and data transfer – and block the data, and notify everyone to whom the Controller transferred the personal data constituting the object of the submitted objection earlier and who are obliged to take measures towards the enforcement of the right of objection.

7. If the data subject does not agree with the Controller’s decision, or if the Controller fails to meet the deadline specified in Section 6, the data subject shall be entitled to turn to court within 30 days from the announcement of such decision.

8. Enforcement of rights before court: In case his/her rights are infringed, the data subject may turn to court. The court shall proceed immediately in such cases. The burden to prove that the data has been controlled in compliance with the relevant legislation shall lie with the Controller.

9. In case of the infringement of your right of informational self-determination, you may submit a report or complaint to:

1. Hungarian National Authority for Data Protection and Freedom of Information

[Nemzeti Adatvédelmi és Információszabadság Hatóság]
Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c., Hungary
Telephone: +36 (1) 391-1400
Fax: +36 (1) 391-1410
www: http://www.naih.hu
e-mail: ugyfelszolgalat@naih.hu

10. In case of content harmful to minors, raising hatred, or being discriminative; or in relation to corrections, the infringement of your rights related the rights of deceased persons or an injury of good reputation, you may submit a report or complaint to:

1. National Media and Infocommunications Authority

[Nemzeti Média- és Hírközlési Hatóság]
1015 Budapest, Ostrom u. 23-25., Hungary
Mailing address: 1525 Budapest, Pf. 75., Hungary
Tel: +36 (1) 457 7100
Fax: +36 (1) 356 5520
E-mail: info@nmhh.hu

Veszprém, 25 June 2012

Gábor Zoltán Nagy, Chief Executive Officer