Privacy Policy

1. GENERAL PROVISIONS

MindenNapHétvége Kft., located at 8747 Garabonc, Zártkert 766, as the operator of the VillaPince guesthouse, ensures the lawfulness and purposefulness of all personal data processing it carries out. The purpose of this Privacy Notice is to provide guests who make a reservation and share their personal data with our company with adequate information – even before submitting their reservation or personal data – about how we process their data, under what conditions and guarantees, and for how long.
Our company complies with the principles set out in this notice in all cases involving the processing of personal data, and considers the contents of this document binding upon itself.

We reserve the right to modify the contents of this unilateral legal statement. In such cases, we will inform the affected parties in advance. If you have any questions regarding the content of this notice, please contact us by email.
The processing of personal data by our company is based on the voluntary consent of the data subjects or, in some cases, is necessary to take steps at the request of the data subject prior to entering into a contract.

Our data processing activities comply with applicable legislation, in particular:

Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: “GDPR”);
Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (“Info Act”).

Our company details and contact information are as follows: Name: MindenNapHétvége Kft. Registered office: HU-8747 Garabonc, Zártkert 766 Hungarian tax number: 322995-2-20 EU VAT number: HU32299591 Phone: +36 30 6387071 E-mail: info@villapince.hu

Below we provide detailed information regarding each type of data processing we carry out.

Our guesthouse offers the possibility to book accommodation online in order to provide guests with a fast, convenient, and cost-free way to reserve a room at the VillaPince guesthouse.

Controller of personal data: MindenNapHétvége Kft.

Use of data processors: Our company uses the services of an IT provider to operate the online booking system, as detailed below.

Name of the data processor	Registered office	Description of the data processing activities
NetHotelBooking Kft.	8200 Veszprém, Boksa tér 1/A	Providing the possibility of online accommodation booking through the RESnWEB system, operation of the pre-arrival email module

By accepting this privacy notice, the data subject gives their explicit consent for the Data Processor to engage additional data processors – in order to make the service more convenient and personalized – as detailed below.

Name of the data processor	Registered office	Description of the data processing activities
BIG FISH Payment Services Kft.	1066 Budapest, Nyugati tér 1-2	Facilitating the data communication required for payment transactions between the merchant and the payment service provider’s systems, and ensuring the traceability of transactions for merchant partners.
OTP Mobil Kft.	1093 Budapest, Közraktár u. 30-32.	Facilitating the data communication required for payment transactions between the merchant and the payment service provider’s systems, providing customer support to users, confirming transactions, and conducting fraud monitoring to protect users.
Felhőmatrac Kft.	1071 Budapest Damjanich utca 35. 3. em. 17.	Provision of channel manager service tasks.

Possible consequences of not providing data: Providing personal data is voluntary. However, it is important to note that fields marked with an asterisk (*) are mandatory – if these are not completed, the booking cannot be finalized. Leaving other fields empty does not have such consequences.

Rights of the data subject: A data subject (the individual whose personal data is processed by our company) has the right to:

request access to their personal data;
request the rectification of their data;
request the erasure of their data;
withdraw their consent to data processing – in such case, the withdrawal does not affect the lawfulness of processing based on consent before its withdrawal;
request restriction of processing under the conditions set out in Article 18 of the GDPR (i.e. the data should not be erased or destroyed until requested by a court or authority, but for no longer than thirty days, and during this time the data shall not be processed for any other purpose);
object to the processing of their personal data;
exercise the right to data portability.
This means the data subject has the right to receive their personal data in Word or Excel format, and to request that our company transmit such data to another data controller upon request.

Other information related to data processing:

By making a reservation, the data subject also declares that the personal data provided are accurate and that they are at least 16 years of age.

To assist our guests in preparing for their trip and to shorten the check-in process upon arrival, we provide practical and relevant information, including weather forecasts, program recommendations, and online check-in options. For this purpose, we send guests a so-called pre-arrival email before their arrival, containing information about the accommodation, travel, and available programs. Based on this pre-arrival email, guests can complete an online registration form, which allows them to speed up the check-in process at the property.

Our company takes all necessary technical and organizational measures to prevent any potential data protection incidents (e.g. damage to, loss of, or unauthorized access to files containing personal data). In the event that such an incident does occur, we maintain a log for the purpose of reviewing the measures taken and informing the affected parties. This log includes the categories of personal data involved, the number and categories of individuals affected by the data protection incident, the time, circumstances, and effects of the incident, the measures taken to remedy it, and any other data as required by applicable data protection legislation..

Our guesthouse offers guests the opportunity to request a quote electronically. The quote is provided by our company through an automated system, taking into account current availability. The controller of personal data is MindenNapHétvége Kft. The purpose of the data processing is to provide preliminary information about the prices of the accommodation. The legal basis for the processing is the prior consent of the person requesting the accommodation, in accordance with Article 6(1)(a) of the GDPR, as well as the necessity of taking steps at the request of the data subject prior to entering into a contract, as provided under Article 6(1)(b) of the GDPR.

The personal data processed for this purpose include the title, first and last name, telephone number, email address, and the number of guests. The data will be retained for a period of two years following the last day of the planned stay indicated in the booking.

A jelen adatkezelési tájékoztató elfogadásával az érintett kifejezett hozzájárulását adja ahhoz, hogy az Adatfeldolgozó – a szolgáltatás kényelmesebbé, testreszabottá tétele érdekében – további adatfeldolgozókat vegyen igénybe a következők szerint.

Possible consequences of not providing data: Providing personal data is voluntary. However, it is important to note that fields marked with an asterisk (*) are mandatory. If these fields are not completed, the guesthouse will be unable to provide a quote. Leaving the remaining fields blank does not carry such consequences.

Rights of the data subject:

The data subject (i.e. the person whose personal data is processed by our company) has the right to:

request access to their personal data;
request the rectification of their data;
request the erasure of their data;
withdraw their consent to data processing (in which case the withdrawal does not affect the lawfulness of processing carried out before the withdrawal);
request the restriction of processing under the conditions set out in Article 18 of the GDPR (i.e. the company shall not delete or destroy the data until a court or authority requests otherwise, for a maximum of thirty days, and the data shall not be processed for any other purpose during that time);
object to the processing of their personal data;
exercise their right to data portability (i.e. the data subject is entitled to receive their personal data in Word or Excel format and may request that our company transfer these data to another data controller upon request).

Other information related to data processing: Our company takes all necessary technical and organizational measures to prevent any potential data protection incidents (e.g. damage to, loss of, or unauthorized access to files containing personal data). In the event that such an incident nevertheless occurs, we maintain a record for the purpose of reviewing the measures taken and informing the affected data subjects. This record includes the categories of personal data concerned, the number and type of individuals affected by the data protection incident, the date, circumstances, and effects of the incident, the measures taken to remedy it, and any additional data required by applicable data protection laws..

Our guesthouse maintains contact with its guests via newsletters, through which we inform them about our services, special offers, and updates related to our operations.

The controller of personal data is MindenNapHétvége Kft. The purpose of data processing is to maintain communication with potential guests. The legal basis for the processing is the data subject’s consent, in accordance with Article 6(1)(a) of the GDPR.

The legitimate interest behind the data processing is to maintain and strengthen business relationships with our partners and guests.

The personal data processed include the name and email address of the data subject. The data will be processed until the individual unsubscribes from the newsletter.

Our company uses the assistance of an IT service provider in connection with the online booking system, as detailed below.

Name of the data processor	Registered office	Description of the data processing activities
NetHotelBooking Kft.	8200 Veszprém, Boksa tér 1/A	Storage of the newsletter mailing list database

Possible consequences of not providing data: If the data subject does not provide their personal data, they will not receive newsletters from our company.

Rights of the data subject:

The data subject (i.e. the person whose personal data is processed by our company) has the right to:

request access to their personal data;
request the rectification of their data;
request the erasure of their data;
withdraw their consent to data processing (the withdrawal does not affect the lawfulness of processing based on consent before its withdrawal);
request the restriction of data processing under the conditions set out in Article 18 of the GDPR (meaning the data will not be deleted or destroyed until requested by a court or authority, for a maximum of thirty days, and will not be used for any other purpose during that period);
object to the processing of their personal data;
exercise their right to data portability (this means the data subject is entitled to receive their personal data in Word or Excel format and may request that our company transfer the data to another data controller).
The data subject may unsubscribe from the newsletter at any time by sending an email to info@villapince.hu or by clicking the unsubscribe link in the newsletter. In such cases, the email address will be promptly deleted from our database.

Other information related to data processing: Our company takes all necessary technical and organizational measures to prevent potential data protection incidents (such as the damage, loss, or unauthorized access to files containing personal data). In the event that such an incident nevertheless occurs, we maintain a record for the purpose of reviewing the measures taken and informing the affected data subjects. This record includes the categories of personal data involved, the number and categories of individuals affected by the incident, the date, circumstances, and effects of the incident, the corrective actions taken, and any additional information required by applicable data protection legislation.

As a guesthouse, our goal is to provide our guests with high-quality services. To achieve this, we continuously seek feedback from our guests regarding their experiences during their stay. The controller of personal data is MindenNapHétvége Kft. The purpose of the data processing is to request feedback from guests in order to further improve and develop our services. The legal basis for processing is the legitimate interest of the private accommodation provider, in accordance with Article 6(1)(f) of the GDPR. Our legitimate interest lies in obtaining relevant insights from guest feedback that support the enhancement of our services. The personal data processed for this purpose include the guest’s name, gender, and email address. The data is retained for two years following the last day of the booked stay. Our company uses the assistance of an IT service provider in connection with the online booking system, as described below.

Name of the data processor	Registered office	Description of the data processing activities
NetHotelBooking Kft.	8200 Veszprém, Boksa tér 1/A	Operation of the satisfaction survey module

Mit der Annahme der vorliegenden Datenschutzerklärung erteilt die betroffene Person ihre ausdrückliche Einwilligung, dass der Auftragsverarbeiter – zum Zweck der komfortableren und individuelleren Gestaltung der Dienstleistung – weitere Auftragsverarbeiter gemäß den nachstehenden Angaben hinzuziehen darf.

Name of the data processor	Registered office	Description of the data processing activities
NetHotelBooking Kft.	8200 Veszprém, Boksa tér 1/A	Operation of the satisfaction measurement module

Possible consequences of not providing data: If the data subject does not provide their personal data, they will not receive a satisfaction survey from our company.

Rights of the data subject: The data subject (i.e. the person whose personal data is processed by our company) has the right to:

request access to their personal data;
request the rectification of their data;
request the erasure of their data;
withdraw their consent to data processing (such withdrawal does not affect the lawfulness of processing carried out before the withdrawal);
request the restriction of processing under the conditions laid down in Article 18 of the GDPR (i.e. our company shall not delete or destroy the data until requested by a court or authority, for a maximum of thirty days, and the data shall not be processed for any other purpose during this period);
object to the processing of their personal data;
exercise their right to data portability (i.e. the data subject is entitled to receive their personal data in Word or Excel format and may request that our company transfer the data to another data controller).

Other information related to data processing: Our company takes all necessary technical and organizational measures to prevent potential data protection incidents (e.g. damage to, loss of, or unauthorized access to files containing personal data). In the event that such an incident nevertheless occurs, we maintain a record to review the actions taken and to inform the data subject. This record includes the categories of personal data concerned, the number and categories of data subjects affected, the date, circumstances, and effects of the incident, the measures taken to address it, as well as any additional information required by applicable data protection legislation.

Our guesthouse provides the option to purchase gift vouchers electronically. The gift voucher is issued through our website by means of an automated system. The controller of personal data is MindenNapHétvége Kft. The purpose of the data processing is the purchase and delivery of gift vouchers. The legal basis for processing is the prior consent of the individual purchasing the gift voucher; by accepting this privacy notice, the data subject gives consent to the processing of their data for the purposes described in this section. The personal data processed includes: title; first and last name; address (country, postal code, city, street, house number); telephone number; email address (both of the purchaser and the recipient); in the case of a business entity, company name and registered office; bank card number, CVC code; and SZÉP card details (card ID, name as shown on the card). The data will be retained for two years following the expiry date of the gift voucher. Our company uses the assistance of an IT service provider for the operation of the online gift voucher system, as detailed below.

Name of the data processor	Registered office	Description of the data processing activities
NetHotelBooking Kft.	8200 Veszprém, Boksa tér 1/A	Operation of the gift voucher module

By accepting this privacy notice, the data subject gives their explicit consent for the Data Processor to engage additional data processors, in order to make the service more convenient and personalized, as detailed below.

Name of the data processor	Registered office	Description of the data processing activities
BIG FISH Payment Services Kft.	1066 Budapest, Nyugati tér 1-2	Facilitating the data communication required for payment transactions between the merchant and the payment service provider’s systems, and ensuring the traceability of transactions for merchant partners.
OTP Mobil Kft.	1093 Budapest, Közraktár u. 30-32.	Facilitating the data communication required for payment transactions between the merchant and the payment service provider’s systems, providing customer support to users, confirming transactions, and conducting fraud monitoring to protect users.

Possible consequences of not providing data: Providing data is voluntary. However, it is important to note that fields marked with an asterisk (*) are mandatory. If these fields are not completed, the purchaser will not be able to buy a gift voucher. Leaving the remaining fields blank does not have such consequences. Rights of the data subject: The data subject (i.e. the individual whose personal data is processed by our company) has the right to:

request access to their personal data;
request the rectification of their personal data;
request the erasure of their personal data;
withdraw their consent to data processing (in which case the withdrawal does not affect the lawfulness of processing carried out before the withdrawal);
request the restriction of processing under the conditions set out in Article 18 of the GDPR (meaning that our company will not delete or destroy the data until requested by a court or authority, but for no longer than thirty days, and will not process the data for any other purpose during this period);
object to the processing of their personal data;
exercise their right to data portability, meaning they are entitled to receive their personal data in Word or Excel format, and have the right to request that our company transmit these data to another data controller.

Other information related to data processing: Our company takes all necessary technical and organizational measures to prevent any potential data protection incidents (such as damage to, loss of, or unauthorized access to files containing personal data). In the event that such an incident nevertheless occurs, we maintain a record in order to review the measures taken and to inform the affected data subjects. This record includes the categories of personal data concerned, the number and types of individuals affected by the incident, the date, circumstances, and effects of the incident, the actions taken to remedy it, as well as any additional information required by the applicable data protection legislation.

To provide a personalized user experience, the Data Controller places a small data file, known as a cookie, on the user’s device, which is then accessed during future visits. If the browser returns a previously stored cookie, the service provider handling the cookie may link the user’s current visit to previous ones, but only in relation to the cookie’s own content.

Purpose of data processing: identifying and distinguishing users, tracking visits, identifying the user’s current session, storing data provided during the session, preventing data loss, conducting web analytics, and providing personalized services.
Legal basis for data processing: the data subject’s consent.
Scope of data processed: identification number, date, time, and the previously visited webpage.
Duration of data processing: up to 90 days.

Name of the data processor	Registered office	Description of the data processing activities
NetHotelBooking Kft.	8200 Veszprém, Boksa tér 1/A	Identification of users and their current session, storage of data provided during the session, prevention of data loss, web analytics, and personalized service delivery.

Further information related to data processing: Cookies can be deleted by the user from their own device, and the use of cookies can also be disabled in the browser settings. Cookie management is typically available in the browser’s Tools/Settings menu, under Privacy/History/Custom Settings, using terms such as cookies, tracking, or similar. Possible consequences of not providing data: If cookies are disabled, the services described in sections 2–5 above may not be accessible or may become unavailable.

8. WEBSITE SERVER LOGGING

When visiting the website nethotelbooking.net, the web server automatically logs the user’s activity.

Purpose of data processing: During website visits, the service provider records visitor data to monitor the operation of the services and to prevent misuse.
Legal basis for data processing: Article 6(1)(f) of the GDPR. Our company has a legitimate interest in ensuring the secure operation of the website.
Types of personal data processed: identification number, date, time, and the URL of the visited page.
Duration of data processing: up to 90 days.

Name of the data processor	Registered office	Description of the data processing activities
NetHotelBooking Kft.	8200 Veszprém, Boksa tér 1/A	Recording visitor data and information necessary for server operation

Further information: When analyzing log files, our company does not link the recorded data to any other information, and we do not attempt to identify individual users. The URLs of the visited pages, along with the date and time, cannot in themselves be used to identify the data subject; however, when combined with other data (such as those provided during registration), they may be capable of being used to draw conclusions about the user.

Data processing by external service providers related to logging: The HTML code of the portal contains references that originate from and point to external servers independent of our company. The external provider’s server communicates directly with the user’s device. We draw the attention of our visitors to the fact that, due to this direct communication with the user’s browser and the connection to the external server, the service providers operating these references may collect user data (e.g., IP address, browser and operating system information, mouse movement, visited page URL, and time of the visit).

The IP address is a sequence of numbers that uniquely identifies the computer or mobile device connecting to the internet. With the help of the IP address, it is even possible to determine the geographic location of the device used by the visitor. While the URL of the visited page and the date and time of access are not sufficient on their own to identify the data subject, when combined with other data (e.g., information provided during registration), they may be capable of being used to draw conclusions about the user.

9. OTHER DATA PROCESSING

For any data processing activities not listed in this notice, we provide information at the time the data is collected. We also inform our clients that certain authorities, public bodies performing official duties, and courts may contact our company to request the disclosure of personal data. In such cases, our company will only disclose personal data to these entities if the request clearly specifies the purpose and the scope of the requested data, and only to the extent strictly necessary to achieve the purpose of the request, and provided that the disclosure is required by law.

10. METHOD OF STORING PERSONAL DATA AND DATA SECURITY

Our company’s IT systems and other data storage locations are located at our registered office and on servers rented by the data processor. When providing its services, our company selects and operates the IT tools used for the processing of personal data in such a way as to ensure that the data:Bei der Erbringung unserer Dienstleistungen wählen und betreiben wir die für die Verarbeitung personenbezogener Daten eingesetzten IT-Systeme so, dass die verarbeiteten Daten:

is accessible to authorized individuals (availability);
is authentic and its authenticity is verifiable (authenticity of data processing);
remains unchanged and its integrity is maintained (data integrity);
is protected against unauthorized access (data confidentiality).

We pay special attention to data security and implement all necessary technical and organizational measures, as well as procedural rules, to ensure compliance with the guarantees required under the GDPR. We protect the data in particular against unauthorized access, alteration, transmission, disclosure, deletion or destruction, as well as accidental destruction or damage and inaccessibility due to changes in the applied technology.

To prevent data protection incidents, our company takes every possible precaution. In the event of an incident, we act immediately in accordance with our incident management policy to minimize risks and mitigate potential damages. Zur Vermeidung von Datenschutzvorfällen trifft unser Unternehmen alle möglichen Maßnahmen. Sollte dennoch ein solcher Vorfall eintreten, handeln wir gemäß unserer Richtlinie zur Vorfallbehandlung unverzüglich, um Risiken zu minimieren und Schäden abzuwenden.

11. RIGHTS OF DATA SUBJECTS AND AVAILABLE REMEDIES

The data subject has the right to request information about the processing of their personal data, and may also request the rectification or – with the exception of mandatory data processing – the deletion or withdrawal of their data, and may exercise their right to data portability and objection through the method indicated at the time of data collection or by contacting the Data Controller via the contact details provided above.
At the request of the data subject, we provide the information electronically without delay, but no later than within 30 days, in accordance with our applicable internal policies. Requests related to the rights listed below are fulfilled free of charge.

Right to be informed:
Our company takes appropriate measures to ensure that all information regarding the processing of personal data – as set out in Articles 13 and 14 of the GDPR – and all notifications referred to in Articles 15 to 22 and Article 34 are provided to data subjects in a concise, transparent, intelligible, and easily accessible form, using clear and plain language, while ensuring accuracy.

The right to information can be exercised in writing through the contact details provided in Section 1. Upon request and after verifying identity, information may also be provided verbally. We inform our clients that if there is any doubt regarding the identity of the data subject, we may request the provision of additional information necessary to confirm their identity. Right of access:
The data subject has the right to obtain confirmation from the Data Controller as to whether or not personal data concerning them is being processed. If such data is being processed, the data subject has the right to access the personal data and the following information listed in the regulation.

The purposes of data processing:

the categories of personal data concerned;
the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries (outside the European Union) or international organisations;
the intended period for which the personal data will be stored;
the right to request rectification or erasure of personal data or restriction of processing, as well as the right to object to such processing;
the right to lodge a complaint with a supervisory authority;
information on the source of the data;
the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

In addition, where personal data is transferred to a third country or to an international organisation, the data subject has the right to be informed of the appropriate safeguards relating to the transfer. Right to rectification: Under this right, any individual may request the correction of inaccurate personal data concerning them that is processed by our company, as well as the completion of incomplete data. Right to erasure (“right to be forgotten”): The data subject has the right to request the erasure of personal data concerning them without undue delay if one of the following grounds applies:

the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
the data subject withdraws their consent on which the processing is based, and there is no other legal ground for the processing;
the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
the personal data have been unlawfully processed;
the personal data must be erased in order to comply with a legal obligation under Union or Member State law applicable to the controller;
the personal data were collected in relation to the offer of information society services.

Exceptions to the right to erasure: The right to erasure does not apply where the processing of personal data is necessary for the following purposes:

exercising the right of freedom of expression and information;
compliance with a legal obligation requiring processing under Union or Member State law applicable to the controller, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
reasons of public interest in the area of public health, or for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes;
the establishment, exercise, or defence of legal claims.

Right to restriction of processing: At the request of the data subject, we restrict processing under the conditions laid down in Article 18 of the GDPR, namely if:

the accuracy of the personal data is contested by the data subject, in which case the restriction applies for a period enabling the verification of the data’s accuracy;
the processing is unlawful and the data subject opposes the erasure of the data and requests the restriction of their use instead;
the controller no longer needs the personal data for the purposes of the processing, but the data subject requires them for the establishment, exercise, or defence of legal claims;
the data subject has objected to processing; in this case, the restriction applies while it is verified whether the legitimate grounds of the controller override those of the data subject.
If processing is restricted, personal data may, with the exception of storage, only be processed with the data subject’s consent, or for the establishment, exercise, or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State. The data subject must be informed in advance before any restriction is lifted.

Right to data portability: The data subject has the right to receive the personal data concerning them, which they have provided to the controller, in a structured, commonly used, and machine-readable format, and to transmit those data to another controller. Our company can fulfil such requests in Word or Excel format.

Right to object: Where personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of their personal data for such purposes, including profiling to the extent that it is related to direct marketing. If the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes. Automated individual decision-making, including profiling: The data subject has the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning them or similarly significantly affects them. This right does not apply if the decision:

is necessary for entering into, or performance of, a contract between the data subject and the controller;
is authorized by Union or Member State law applicable to the controller, which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or
is based on the data subject’s explicit consent.

Right to withdraw consent:
The data subject has the right to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Procedural rules:
The data controller shall provide information on actions taken in response to a request under Articles 15–22 of the GDPR without undue delay and in any case within one month of receipt of the request.
This period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The data controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.

If the data subject submits the request electronically, the information shall be provided in electronic form unless otherwise requested.

If the data controller does not take action on the data subject’s request, the controller shall inform the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

The data controller shall communicate any rectification, erasure, or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves a disproportionate effort. Upon request, the controller shall inform the data subject about those recipients.

Compensation and damages:
Any person who has suffered material or non-material damage as a result of a breach of the data protection regulation is entitled to receive compensation from the data controller or the data processor. The processor shall be liable for the damage caused by processing only if it has not complied with obligations specifically directed to processors under the law or has acted contrary to or without the lawful instructions of the controller.

Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and are responsible for any damage caused, each shall be held jointly and severally liable for the entire damage.

The controller or processor shall be exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.

Right to judicial remedy and supervisory authority procedure:
In the event of a violation of their rights, the data subject may bring an action before a court against the data controller. The court shall act in the case without delay.

A complaint may also be lodged with the Hungarian supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information
Address: H-1055 Budapest, Falk Miksa Street 9–11.
Mailing address: H-1374 Budapest, P.O. Box 603.
Phone: +36 1 391 1400
Email: ugyfelszolgalat@naih.hu