Adatkezelési tájékoztató
Accommodation Provider: Sárffy Vendégház
Effective date: July 20, 2026
1. INTRODUCTION
Katalin Sipeki and Tamás Giebiszer, as the operators of Sárffy Vendégház and Joint Data Controllers, pay special attention to ensuring that the personal data of guests, prospective guests, website visitors, and other data subjects are processed lawfully, fairly, transparently, and securely.
The purpose of this Privacy and Data Protection Notice is to provide data subjects with clear and easily understandable information, prior to providing their personal data, regarding what personal data the Data Controllers process, for what purposes, on what legal bases, for how long, to whom such data may be transferred, and what rights the data subjects possess.
In processing personal data, the Data Controllers pay special regard to the provisions of the following applicable laws:
Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR);
Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (Info Act);
Act CLVI of 2016 on the State Tasks for the Development of Tourism Areas;
Applicable accounting and tax legislation;
Applicable statutory provisions governing accommodation services, guest data management, and data reporting to the NTAK and VIZA systems.
2. DETAILS OF THE DATA CONTROLLERS AND JOINT CONTROLLERSHIP (GDPR ARTICLE 26)
Names of the Data Controllers (Joint Data Controllers):
Katalin Sipeki (private individual with tax number; address: HU-1068 Budapest, Városligeti fasor 28., tax number: 73074072-1-42)
Tamás Giebiszer (private individual with tax number; address: HU-8244 Dörgicse, Diófa u. 14., tax number: 55893213-1-39)
Accommodation name: Sárffy Vendégház
Phone number: +36 70 770 6945
Email address: info@sarffyhaz.hu
Mailing address for data subject requests: 8244 Dörgicse, Diófa u. 14., Hungary
The Data Controllers are not required to designate a Data Protection Officer (DPO).
Essence of the Joint Controllership Agreement (GDPR Article 26(2)):
Allocation of Responsibility: The Data Controllers jointly determine the purposes and means of processing in all data processing operations connected to the operation of the accommodation (booking, invoicing, VIZA/NTAK reporting, guest communications).
Exercise of Data Subject Rights: The data subject (guest, prospective guest) is entitled to exercise their rights under the GDPR against and in respect of each of the Data Controllers (via email or post).
Handling Requests: The Data Controllers are jointly and severally liable among themselves for processing requests in a timely manner.
3. DEFINITIONS
Personal data: Any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Data subject: Any natural person whose personal data are processed by the Data Controllers (e.g., guest, prospective guest inquiring about accommodation, website visitor).
Data controller: The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Data processor: A natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller.
Processing / Data processing: Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Consent: Any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Personal data breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
4. PRINCIPLES RELATING TO PROCESSING OF PERSONAL DATA
The Data Controllers adhere to the following core principles when processing personal data:
Lawfulness, fairness and transparency: Personal data shall be processed lawfully, fairly, and in a transparent manner in relation to the data subject.
Purpose limitation: Personal data shall be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
Data minimisation: Personal data shall be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
Accuracy: Personal data shall be accurate and, where necessary, kept up to date.
Storage limitation: Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
Integrity and confidentiality: Personal data shall be processed in a manner that ensures appropriate security of the personal data using appropriate technical or organisational measures.
Accountability: The Data Controllers are responsible for, and shall be able to demonstrate compliance with, the above principles.
5. DATA PROCESSING RELATED TO ONLINE ACCOMMODATION BOOKING
Sárffy Vendégház offers the option for online accommodation bookings.
Purpose of processing: Recording and confirming room bookings, guest communication, performance of the accommodation services contract, and financial administration related to payment and invoicing.
Legal basis for processing: Performance of a contract (GDPR Article 6(1)(b)) and compliance with a legal obligation (GDPR Article 6(1)(c)).
Categories of data processed: Name, title/salutation, address, phone number, email address, arrival and departure dates, number of guests, booking details, payment details, invoicing details.
Data retention period:
In respect of booking details: the civil law statute of limitations period (5 years);
In respect of invoicing and accounting data: 8 years as mandated by applicable tax and accounting laws.
Data Processors involved: NetHotelBooking Kft. / RESnWEB system, Vendégem accommodation management software, web hosting provider.
Consequences of failure to provide data: If the data subject fails to provide the data necessary for the reservation, the Data Controllers cannot record the booking and cannot conclude the accommodation service contract.
Information on the online booking system operation: The technical infrastructure for the online booking system is provided by our external service provider (NetHotelBooking Kft. / RESnWEB). Detailed information regarding the technical operation, cookies, and data handling of the online booking module is accessible directly on the booking interface.
6. DATA PROCESSING RELATED TO THE CONTACT FORM
Purpose of processing: Handling inquiries, answering questions, and providing general information about the services offered by the guest house.
Legal basis for processing: Consent of the data subject (GDPR Article 6(1)(a)) and taking steps at the request of the data subject prior to entering into a contract (GDPR Article 6(1)(b)).
Categories of data processed: Name, email address, phone number, content of the message.
Data retention period: A maximum of 1 year from the date the inquiry is fully answered.
Consequences of failure to provide data: Providing data is voluntary; however, without providing these details, the Data Controllers will be unable to contact the data subject or respond to their inquiry.
7. DATA PROCESSING RELATED TO PRICE QUOTES AND REQUESTS FOR OFFERS
Purpose of processing: Preparing customized quotes regarding accommodation availability, rates, and services, and preparing for booking.
Legal basis for processing: Consent of the data subject (GDPR Article 6(1)(a)) and taking steps at the request of the data subject prior to entering into a contract (GDPR Article 6(1)(b)).
Categories of data processed: Name, email address, phone number, number of guests, planned arrival and departure dates, additional remarks or comments.
Data retention period: A maximum of 1 year from responding to the request for an offer, or, if a booking is concluded, the retention period applicable to bookings (5 years).
Consequences of failure to provide data: In the absence of data, the Data Controllers cannot provide a customized offer.
8. DIRECT MARKETING AND PROMOTIONAL COMMUNICATIONS
Purpose of processing: Sending promotional updates, special offers, discounts, and news regarding the services of Sárffy Vendégház to the data subject.
Legal basis for processing: Freely given consent of the data subject (GDPR Article 6(1)(a)).
Categories of data processed: Name and email address.
Data retention period: Until consent is withdrawn or until the user unsubscribes.
Unsubscribing: The data subject may withdraw their consent at any time, free of charge and without restriction, or unsubscribe by sending a declaration to info@sarffyhaz.hu.
9. GUEST DATA PROCESSING, VENDÉGEM SOFTWARE, NTAK AND VIZA SYSTEMS
During the provision of accommodation services, the Data Controllers record guest data in the Vendégem software in accordance with statutory requirements and transmit said data to the VIZA and NTAK systems.
Purpose of processing: Lawful provision of accommodation services, maintaining guest records, and fulfilling statutory reporting obligations to the VIZA (Closed Guest Information Database) and NTAK (National Tourism Data Centre) systems.
Legal basis for processing: Compliance with a legal obligation (GDPR Article 6(1)(c); Act CLVI of 2016).
Categories of data processed: First name and surname, place and date of birth, gender, nationality, mother’s maiden name, identity card or travel document identification numbers, arrival and departure dates.
Data retention period: Pursuant to Section 9/H (1) of Act CLVI of 2016 on the State Tasks for the Development of Tourism Areas, the accommodation provider stores the processed data in its own systems until the last day of the calendar year following the year in which it came to its knowledge.
Consequences of failure to provide data: Document scanning and data reporting are legal obligations. If a guest fails or refuses to present their identification document, the accommodation provider is required by law to refuse the provision of accommodation services.
10. DATA PROCESSING RELATED TO INVOICING
Purpose of processing: Issuing tax invoices, fulfilling accounting, tax, and record-keeping statutory obligations.
Legal basis for processing: Compliance with a legal obligation (GDPR Article 6(1)(c); Section 169 of the Accounting Act).
Categories of data processed: Billing name, billing address, tax number (for corporate clients), email address, description of service provided, consideration amount.
Data retention period: 8 years from the issuance of the invoice pursuant to the Accounting Act.
Consequences of failure to provide data: Provision of data is mandatory; without it, invoices cannot be lawfully issued.
11. DATA PROCESSING RELATED TO PAYMENTS
Purpose of processing: Settlement of service charges, payment confirmation, and financial administration.
Legal basis for processing: Performance of a contract (GDPR Article 6(1)(b)) and compliance with a legal obligation (GDPR Article 6(1)(c)).
Categories of data processed: Name, payment transaction reference ID, transaction data, payment amount, and timestamp. The Data Controllers do not directly store credit/debit card numbers.
Data retention period: The period required for the fulfillment of tax and accounting obligations (8 years).
12. DATA PROCESSING RELATED TO CCTV SURVEILLANCE
If a CCTV security camera system is operational on the premises of Sárffy Vendégház, the cameras monitor strictly outdoor areas (entrance, yard, parking area).
The camera system does not monitor internal or private spaces (specifically excluding living areas, bedrooms, and bathrooms of the guest apartments).
Purpose of processing: Asset protection, safety of persons and property, prevention, detection, and proof of damages or unlawful actions.
Legal basis for processing: Legitimate interests pursued by the Data Controllers (GDPR Article 6(1)(f)).
Categories of data processed: Facial image, physical movement captured on camera, date and time of footage.
Data retention period: Video recordings are retained for 7 days, unless longer retention is required due to an unlawful act or official law enforcement proceedings.
Warning signs: Prominent notification signage regarding CCTV surveillance is posted at the premises.
Data subject rights: Data subjects have the right to request information regarding video recordings concerning them and to exercise their rights under the GDPR.
13. COOKIES AND WEBSITE USAGE DATA
The website sarffyhaz.hu may use cookies to ensure proper operation, enhance user experience, generate statistical analytics, and conduct marketing measurement.
Purpose of processing: Ensuring proper website functionality, compiling visitor statistics, website development, and—subject to consent—marketing and advertising analytics.
Legal basis for processing:
For strictly necessary operational cookies: legitimate interest of the Data Controllers (GDPR Article 6(1)(f));
For statistical, performance, and marketing cookies: freely given consent of the data subject (GDPR Article 6(1)(a)).
Categories of data processed: IP address, browser type, operating system, device parameters, date/time of visit, pages viewed, cookie IDs.
Analytics and Marketing tools: The website may utilize tools such as Google Analytics, Meta Pixel, or other measurement and marketing tools, provided the data subject has given prior consent via the cookie management banner.
Cookie settings and withdrawal: Users can modify, limit, or decline cookies at any time through their browser settings or via the cookie preference management banner on the website.
14. DATA PROCESSING RELATED TO SOCIAL MEDIA PLATFORMS
Purpose of processing: Communicating with interested parties, presenting the guest house, and publishing services, promotions, and special offers.
Legal basis for processing: Voluntary consent of the data subject (by following, liking, commenting, or messaging).
Categories of data processed: Profile name, public profile data, user comments, messages, likes.
Transfers outside the EEA and safeguards: When using Meta platforms (Facebook/Instagram), data may be transferred to the United States. Such transfers are governed by the EU-US Data Privacy Framework adequacy decision and the European Commission’s Standard Contractual Clauses (SCCs).
15. DATA TRANSFERS AND DATA PROCESSORS
The Data Controllers will only transfer personal data to third parties in cases mandated by law or to designated Data Processors:
NetHotelBooking Kft. / RESnWEB: Operation of the online reservation booking engine;
Vendégem software / NTAK / VIZA: Statutory guest registration and mandatory tourism data reporting;
Számlázz.hu / NAV (National Tax and Customs Administration): Online invoicing software and tax authority reporting;
Accounting Firm: Performance of accounting, bookkeeping, and tax obligations;
Web Hosting and IT Service Provider: Maintenance and hosting of website, server, and email infrastructure.
The Data Controllers execute written Data Processing Agreements with all processors to guarantee that personal data is handled strictly according to the Controllers’ instructions and in compliance with the GDPR and applicable laws.
16. CATEGORIES OF PERSONS AUTHORIZED TO ACCESS DATA
Personal data may only be accessed by the Data Controllers and designated employees/representatives of the Data Processors, strictly to the extent necessary to perform their operational duties.
The Data Controllers will not disclose data to unauthorized third parties unless required to do so by applicable law, a court order, or an official authority.
17. DATA SECURITY MEASURES
The Data Controllers implement appropriate technical and organizational measures to safeguard personal data against unauthorized access, alteration, transmission, disclosure, erasure, destruction, or accidental loss or damage:
Use of password-protected, closed IT infrastructure;
Strictly restricted user access permissions;
Regular data backups and system security updates;
Storage of paper-based documents in locked, secure premises.
18. MANAGEMENT OF PERSONAL DATA BREACHES
A personal data breach is any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data processed.
In the event of a personal data breach, the Data Controllers shall notify the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the breach is likely to result in a high risk, the Data Controllers shall communicate the breach to the data subjects without undue delay.
19. RIGHTS OF THE DATA SUBJECT
Under the GDPR, data subjects possess the following rights regarding their personal data:
Right of access (GDPR Article 15): The data subject has the right to obtain confirmation from the Data Controllers as to whether or not personal data concerning them are being processed, and access to the personal data and related information.
Right to rectification (GDPR Article 16): The data subject has the right to obtain without undue delay the rectification of inaccurate personal data or completion of incomplete personal data.
Right to erasure (“Right to be forgotten”) (GDPR Article 17): The data subject has the right to request the erasure of personal data without undue delay where statutory conditions apply (e.g., data no longer necessary, consent withdrawn with no other legal ground).
Right to restriction of processing (GDPR Article 18): The data subject has the right to obtain restriction of processing where statutory conditions are met (e.g., accuracy of data is contested).
Right to data portability (GDPR Article 20): The data subject has the right to receive personal data concerning them in a structured, commonly used and machine-readable format.
Right to object (GDPR Article 21): The data subject has the right to object at any time on grounds relating to their particular situation to processing based on legitimate interests.
Right to withdraw consent (GDPR Article 7(3)): Where processing is based on consent, the data subject has the right to withdraw consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
20. HANDLING OF DATA SUBJECT REQUESTS
Data subjects may submit requests regarding the exercise of their rights using the following contact details:
Email: info@sarffyhaz.hu
Mailing address: 8244 Dörgicse, Diófa u. 14., Hungary
The Data Controllers shall examine the request without undue delay and at the latest within 1 month of receipt, informing the data subject in writing or electronically of the action taken.
21. LEGAL REMEDIES
If a data subject considers that the processing of personal data relating to them infringes the GDPR or applicable data protection laws, they may seek the following remedies:
1. Lodging a complaint with the Supervisory Authority:
National Authority for Data Protection and Freedom of Information (NAIH)
Headquarters: 1055 Budapest, Falk Miksa utca 9-11., Hungary
Mailing address: 1363 Budapest, Pf. 9., Hungary
Phone: +36 (1) 391-1400
Email: ugyfelszolgalat@naih.hu
Website: https://naih.hu
2. Judicial remedy (Court proceedings):
Data subjects may initiate court proceedings against the Data Controllers if their rights have been violated. Judicial proceedings fall under the jurisdiction of the Regional Court (Törvényszék). At the choice of the data subject, the lawsuit may also be brought before the Regional Court having jurisdiction over the data subject’s place of residence or place of stay.
22. RECORDS OF PROCESSING ACTIVITIES
In compliance with GDPR Article 30, the Data Controllers maintain internal records of processing activities under their responsibility, data processors engaged, and any data protection incidents.
23. AUTOMATED DECISION-MAKING AND PROFILING
The Data Controllers do not engage in automated decision-making or profiling that would produce legal effects concerning data subjects or similarly significantly affect them.
24. AMENDMENTS TO THIS PRIVACY NOTICE
The Data Controllers reserve the right to unilaterally amend this Privacy and Data Protection Notice to reflect changes in legal regulations or operational data processing practices.
The current effective version of this Notice is always accessible on the official website of Sárffy Vendégház (sarffyhaz.hu).