Apartman 360 Balatonalmádi
Effective from: 12 May 2026
Data Controller: Simon Ildikó
Name of accommodation: Apartman 360 Balatonalmádi
1. Introduction
Simon Ildikó, as the operator of Apartman 360 Balatonalmádi, pays particular attention to processing the personal data of guests, enquirers, website visitors and other data subjects lawfully, fairly, transparently and securely.
The purpose of this privacy and data protection notice is to provide data subjects, before they provide their personal data, with clear and understandable information about what personal data the data controller processes, for what purpose, on what legal basis, for how long, to whom the data may be transferred, and what rights data subjects have.
When processing personal data, the data controller takes into account in particular the provisions of the following legislation:
Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation, hereinafter: GDPR;
Act CXII of 2011 on Informational Self-Determination and Freedom of Information, hereinafter: the Info Act;
accounting and tax legislation;
the applicable legislation concerning accommodation services, guest data processing, and NTAK and VIZA data reporting.
The data controller considers the provisions of this notice binding upon itself and reserves the right to amend this notice in the event of changes in legislation, the introduction of a new data processing process, the use of a new data processor, or changes in the operation of the service.
2. Details of the Data Controller
Name of data controller: Simon Ildikó
Name of accommodation: Apartman 360 Balatonalmádi
Registered office / address: 8220 Balatonalmádi, Kerkápoly utca 5.
Tax number: 70867994-1-41
Telephone number: +36 30 234719
E-mail address: info@apartman360.hu
Website: apartman360.hu
The data controller is not obliged to appoint a data protection officer; therefore, no separate data protection officer has been appointed.
3. Definitions
Personal data: any information relating to an identified or identifiable natural person. This may include, for example, name, address, e-mail address, telephone number, identity document number, birth data, IP address or an image visible on camera footage.
Data subject: the natural person whose personal data are processed by the data controller. Under this notice, data subjects may include, in particular, guests, enquirers, persons making a booking, newsletter subscribers, website visitors or persons observed by a camera system.
Data controller: the person or organisation that determines the purposes and means of processing personal data. In this case, the data controller is Simon Ildikó.
Data processor: the person or organisation that processes personal data on behalf of the data controller. This may include, for example, the provider of the booking system, the invoicing system, the hosting provider or the IT service provider.
Data processing: any operation performed on personal data, including in particular the collection, recording, storage, organisation, transfer, modification, erasure or destruction of data.
Consent: the voluntary, specific, informed and unambiguous statement of the data subject by which they agree to the processing of their personal data.
Personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, personal data processed.
4. Principles of Data Processing
When processing personal data, the data controller follows the principles below:
Lawfulness, fairness and transparency: the data controller processes personal data only lawfully, fairly and in a manner transparent to data subjects.
Purpose limitation: personal data may only be processed for specified, explicit and legitimate purposes. The data controller does not process data for any purpose incompatible with the original processing purpose.
Data minimisation: the data controller processes only personal data that are necessary to achieve the given purpose.
Accuracy: the data controller endeavours to ensure that the personal data processed are accurate and up to date. The data subject may request the rectification of inaccurate data.
Storage limitation: the data controller processes personal data only for as long as necessary to achieve the relevant processing purpose, comply with a legal obligation or enforce a legitimate claim.
Integrity and confidentiality: the data controller ensures the security of personal data through appropriate technical and organisational measures.
Accountability: the data controller is responsible for ensuring that data processing complies with the GDPR and the applicable legal requirements.
5. Data Processing Related to Online Accommodation Booking
Apartman 360 Balatonalmádi provides the possibility of online accommodation booking so that guests can reserve accommodation quickly and conveniently.
Purpose of data processing: recording and confirming accommodation bookings, maintaining contact with the guest, providing the accommodation service, administration related to payment and invoicing, and providing information related to the booking.
Legal basis for data processing:
performance of a contract and taking steps prior to entering into a contract;
compliance with a legal obligation where the processed data are required by law; consent of the data subject where the processing is optional, for example in connection with marketing notifications.
Categories of data processed include in particular: name, title, address, telephone number, e-mail address, arrival and departure dates, number of guests, booking details, payment details, invoicing details, and, in the case of company invoicing, company name, registered office and tax number.
In the case of online check-in or guest data registration, the data controller may also process guest data required by law, including in particular place and date of birth, nationality, type and number of identity document, and arrival and departure data.
Duration of data processing:
in the case of booking-related data, 2 years from the last day of the stay;
in the case of invoicing and accounting data, the retention period prescribed by law, typically 8 years;
in the case of a legal claim, for the period necessary to enforce the claim.
The following may participate as data processors in particular: NetHotelBooking Kft. / RESnWEB system, Vendégem accommodation software, hosting provider, IT service provider and, in the case of online payment, a payment service provider.
Providing certain data is a condition for fulfilling the booking. If the data subject does not provide the data necessary for the booking, the data controller will be unable, or only partially able, to provide the accommodation service.
6. Data Processing Related to the Contact Form
The website provides the possibility to use a contact form. Through the form, enquirers may ask questions, request an offer or contact the operator of the apartment.
Purpose of data processing: making contact, responding to enquiries, providing offers, and consultation related to bookings.
Legal basis for data processing: the consent of the data subject, as well as taking steps prior to entering into a contract.
Categories of data processed: name, e-mail address, telephone number, content of the message, and any other data voluntarily provided by the data subject.
Duration of data processing: for a maximum of 2 years from responding to the enquiry, or, if a booking is made, according to the retention period applicable to booking-related data.
Providing the data is voluntary; however, without a name and contact details, the data controller cannot respond to the enquiry.
7. Data Processing Related to Offer Requests
The data controller may provide the possibility for enquirers to request an offer electronically.
Purpose of data processing: informing the enquirer about the availability, prices and services of the apartment, and preparing a possible booking.
Legal basis for data processing: the consent of the data subject, as well as taking steps prior to entering into a contract.
Categories of data processed: name, e-mail address, telephone number, number of guests, arrival and departure dates, and any other information provided in the offer request.
Duration of data processing: for a maximum of 2 years from responding to the offer request, or, if a booking is made, according to the processing period applicable to booking data.
8. Marketing Contact and Notifications about Offers
In the booking system, the guest may choose whether they would like to be among the first to hear about the best offers. If the guest voluntarily selects this option, the data controller may process their e-mail address for marketing purposes.
Purpose of data processing: sending information about discounts, offers, news and the services of Apartman 360 Balatonalmádi.
Legal basis for data processing: the voluntary consent of the data subject.
Categories of data processed: name and e-mail address.
Duration of data processing: until consent is withdrawn or until unsubscribing.
The data subject is entitled to unsubscribe or withdraw their consent at any time by sending an e-mail to info@apartman360.hu. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
9. Processing of Guest Data, Vendégem Accommodation Software, NTAK and VIZA
During the provision of accommodation services, the data controller records data relating to guests in accordance with legal requirements. Guest data are registered in the Vendégem accommodation software.
Purpose of data processing: lawful provision of accommodation services, maintaining a guest register, fulfilling data reporting obligations prescribed by law, and NTAK and VIZA data reporting.
Legal basis for data processing: compliance with a legal obligation.
Categories of data processed include in particular: name, place and date of birth, nationality, address, type and number of identity document, arrival and departure data, and other data prescribed by law.
The recording and transfer of guest data are carried out on the basis of a legal obligation. Failure to provide the data may prevent the provision of the accommodation service.
Data processor / system: Vendégem accommodation software, NTAK and VIZA system.
10. Data Processing Related to Invoicing
The data controller issues an invoice for the consideration paid for the accommodation service. Invoicing is carried out using the Számlázz.hu system.
Purpose of data processing: issuing invoices and fulfilling bookkeeping, tax and accounting obligations.
Legal basis for data processing: compliance with a legal obligation.
Categories of data processed: billing name, billing address, tax number, e-mail address, name of service, consideration, payment data.
Duration of data processing: the statutory retention period applicable to accounting documents, typically 8 years.
Data processor: Számlázz.hu / KBOSS.hu Kft.
Data processing task: providing an online invoicing system.
11. Data Processing Related to Payment
If the guest uses online payment, card payment, bank transfer or another electronic payment method, an external payment service provider may also participate in the processing of payment data.
Purpose of data processing: payment of the consideration for the accommodation service, payment confirmation and financial administration.
Legal basis for data processing: performance of a contract and compliance with a legal obligation.
Categories of data processed: name, payment identifier, transaction data, payment amount, payment date and invoicing data. The data controller does not necessarily process bank card data directly; if online card payment is made, the payment service provider acts in accordance with its own privacy rules.
Duration of data processing: for the period necessary to fulfil accounting and tax obligations.
12. Data Processing Related to Camera Surveillance
A security camera system operates on the premises of Apartman 360 Balatonalmádi. The cameras monitor only external areas, in particular the street frontage, the courtyard and the area around the entrance.
The camera system does not monitor internal, privately used premises. The surveillance does not extend to the apartment living area, sleeping area, bathroom, toilet or any other area belonging to the private sphere.
Purpose of data processing: protection of property, personal and property security, prevention of infringements, and, where necessary, proving infringements, damage or other security incidents.
Legal basis for data processing: the legitimate interest of the data controller.
Categories of data processed: the image of the data subject, their movement, events visible on the recording, and the time the recording was made.
Duration of data processing: camera recordings are retained for 7 days, unless longer retention is necessary due to a legal claim, an authority request or a security incident.
The data controller places clearly visible warning notices about camera surveillance. The data subject is entitled to request information about the processing of footage concerning them and to exercise their rights under the GDPR.
13. Cookies and Website Usage Data
The apartman360.hu website may use cookies to ensure proper operation, improve the user experience, perform statistical analysis and carry out marketing measurements.
Purpose of data processing: ensuring the proper operation of the website, preparing visitor statistics, developing the website and, in the case of consent, marketing and advertising measurement.
Legal basis for data processing:
in the case of cookies necessary for operation, the legitimate interest of the data controller;
in the case of statistical and marketing cookies, the consent of the data subject.
Categories of data processed: IP address, browser type, device data, time of visit, pages viewed and cookie identifiers.
The website may use, for example, Google Analytics, Meta Pixel or other measurement and marketing tools, provided that the data subject has given prior consent to these.
The data subject may modify or refuse the use of cookies in their browser settings or through the cookie management interface displayed on the website.
14. Data Processing Related to Social Media Platforms
The data controller may also use social media platforms, for example Facebook or Instagram pages.
Purpose of data processing: maintaining contact with enquirers and guests, presenting the apartment, and providing information about services, offers and news.
Legal basis for data processing: the consent of the data subject, which may be given, for example, by following, commenting, sending a message or other activity, and in certain cases the legitimate interest of the data controller.
Categories of data processed: the data subject’s social media profile name, public profile data, comments, messages, reactions and any other data voluntarily provided by the data subject.
Duration of data processing: until the data subject withdraws their consent, until the purpose of the message exchange ceases, or for the period determined by the rules of the social media platform.
Social media platforms may also process data as independent data controllers in accordance with their own privacy rules.
15. Data Transfers and Data Processors
The data controller transfers personal data to a third party only if this is necessary for the performance of the service, compliance with a legal obligation, enforcement of a legitimate interest, or on the basis of the data subject’s consent.
Possible data processors and recipients:
NetHotelBooking Kft. / RESnWEB – online booking system, offer request module, pre-arrival e-mail module;
Vendégem accommodation software – recording guest data and supporting NTAK and VIZA data reporting;
Számlázz.hu / KBOSS.hu Kft. – online invoicing system;
accountant – fulfilling accounting and tax obligations;
hosting provider – operation of the website;
IT service provider – operation of the website, e-mail and other IT systems;
payment service provider – in the case of online or card payment;
newsletter sending or marketing system – if the data controller uses such a system;
competent authorities – on the basis of a legal obligation.
The data controller concludes an agreement with data processors or uses a service that ensures the appropriate protection of personal data.
Transfer of data to a third country may take place only if an appropriate legal basis and safeguards under the GDPR are available.
16. Persons Entitled to Access the Data
Personal data may be accessed by the data controller and persons authorised to act on behalf of the data controller, solely to the extent necessary for the performance of their duties.
Personal data may also be accessed by data processors, such as the booking system, invoicing system, hosting provider, accountant, IT service provider, or an authority acting on the basis of law.
The data controller does not disclose personal data to unauthorised persons.
17. Data Security
The data controller applies appropriate technical and organisational measures to ensure that personal data are protected against unauthorised access, alteration, transfer, disclosure, erasure, damage or destruction.
The data controller may in particular apply the following measures:
use of password-protected systems;
restriction of access rights;
regular data backups;
protection of IT systems;
storage of paper-based documents in a locked place;
contractual safeguards with data processors;
application of an incident management procedure where necessary.
The data controller ensures that data are accessible only to those for whom access is actually necessary for the purposes of data processing.
18. Handling of Personal Data Breaches
A personal data breach means any security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, personal data processed.
This may include, for example:
sending an e-mail containing personal data to the wrong recipient;
loss of a document containing guest data;
unauthorised access to booking or invoicing data;
hacking of an IT system;
unauthorised viewing of camera footage.
In the event of a personal data breach, the data controller examines the incident without delay, assesses its risk, takes the necessary measures and, where required by law, notifies the Hungarian National Authority for Data Protection and Freedom of Information.
If the personal data breach is likely to result in a high risk to the rights and freedoms of data subjects, the data controller also informs the data subjects.
The data controller keeps a record of personal data breaches.
19. Rights of Data Subjects
Data subjects have the following rights in relation to the processing of their personal data:
Right of access: the data subject may request information as to whether the data controller processes their personal data and, if so, what data are processed, for what purpose, on what legal basis, for how long and to whom the data are transferred.
Right to rectification: the data subject may request the rectification of inaccurate personal data and the completion of incomplete data.
Right to erasure: the data subject may request the erasure of their personal data if the purpose of processing has ceased, the legal basis for processing no longer exists, or other statutory conditions for erasure are met.
Right to restriction of processing: the data subject may request that the data controller process their personal data only in a restricted manner, for example in the event of a legal dispute or an objection concerning accuracy.
Right to data portability: in the case of automated processing based on consent or a contract, the data subject may request to receive the data concerning them in a structured, commonly used and machine-readable format.
Right to object: the data subject may object to processing based on legitimate interest.
Right to withdraw consent: where processing is based on consent, the data subject may withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing carried out previously.
Right to lodge a complaint: the data subject may lodge a complaint with the supervisory authority if they consider that the processing of their personal data is unlawful. The NAIH also publishes a separate notice on the exercise of data subject rights in relation to processing falling under the GDPR.
20. Handling Data Subject Requests
The data subject may submit requests concerning the processing of their personal data using the following contact details:
E-mail: info@apartman360.hu
Postal address: 8220 Balatonalmádi, Kerkápoly utca 5.
The data controller responds to data subject requests without undue delay and no later than within 1 month. Where necessary, taking into account the complexity of the request and the number of requests, this deadline may be extended in accordance with the GDPR rules.
Before fulfilling the request, the data controller is entitled to verify the identity of the person submitting the request where necessary.
21. Legal Remedies
If the data subject considers that the processing of their personal data is unlawful, they may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information.
Hungarian National Authority for Data Protection and Freedom of Information
Registered office: 1055 Budapest, Falk Miksa utca 9-11.
Postal address: 1363 Budapest, P.O. Box 9.
Website: naih.hu
E-mail: ugyfelszolgalat@naih.hu
The data subject is also entitled to bring proceedings before a court. The proceedings may also be brought, at the data subject’s choice, before the tribunal competent according to their place of residence or stay.
22. Records of Data Processing Activities
The data controller may keep records of its data processing activities in accordance with the requirements of the GDPR. The records may contain, in particular, the purposes of processing, the categories of data subjects and data processed, recipients, data transfers, retention periods and data security measures.
The data controller may keep separate records of personal data breaches, containing the circumstances and effects of the breach, the categories of data concerned, the number of data subjects affected, the measures taken and, where necessary, the details of the notification to the authority.
23. Automated Decision-Making and Profiling
The data controller does not carry out automated decision-making concerning data subjects that would produce legal effects concerning them or similarly significantly affect them.
Where marketing and statistical tools are used, the providers of such tools may analyse data relating to website traffic, interests or advertising performance. Such processing may take place only on the basis of an appropriate legal basis, in particular consent.
24. Amendment of this Notice
The data controller reserves the right to amend this privacy and data protection notice, in particular in the event of changes in legislation, a new data processing activity, a new data processor, a new website function or changes in the operation of the service.
The privacy notice currently in force is available on the website of Apartman 360 Balatonalmádi.