Privacy Notice
How the operator of Páter Apartmanok és Szobák processes the personal data of guests and website visitors.
1. Controller
Cseles Csibe Kereskedelmi, Vendéglátó és Szolgáltató Korlátolt Felelősségű Társaság (short name: Cseles Csibe Kft.)
Registered office (per the company register): 8600 Siófok, Kinizsi utca 11., Hungary
Company registration number: 14-09-322162 (Court of Registration of the Kaposvár Regional Court)
Tax number: 33050564-2-14
Email: patersiofok@hotmail.com · Phone: +36 30 476 0210
For privacy matters, contact the controller using the details above.
Legal framework: Regulation (EU) 2016/679 (GDPR) and Hungarian Act CXII of 2011 (Infotv.).
2. Processing activities
| Activity | Data | Purpose and legal basis | Retention |
|---|---|---|---|
| Online booking | name, email, phone, address, tax number (optional), dates, number of adults/children/infants, rooms, extras, comment, prices and discounts, booking reference, accepted Terms version and time, confirmation-email delivery status | conclusion and performance of the contract — Art. 6(1)(b); invoicing data: legal obligation — Art. 6(1)(c); establishing, exercising and defending legal claims — GDPR Art. 6(1)(f) | 5 years after the end of the stay; accounting records (e.g. invoices) 8 years (Accounting Act s. 169); tourist-tax data until the right to assess the tax lapses; booking-related correspondence for the same period as the booking. For a cancelled booking the 5 years run from the latest of the cancellation, the last payment and the last refund; for a no-show, from the later of the scheduled departure date and the recording of the no-show. |
| Enquiries and emailed offers | name, email, phone, room type, guests, dates, message, language, IP address of the enquiry; for offers also address, tax number, prices, payments | pre-contractual steps and performance — Art. 6(1)(b); IP address for abuse prevention — Art. 6(1)(f); establishing, exercising and defending legal claims — GDPR Art. 6(1)(f) | if no booking followed: 1 year after the last contact; if it did, the booking’s retention period |
| Guest account | name, email, password (bcrypt hash), phone, address, tax number, language, loyalty level, coupons, login times, one-time tokens (hashed), session ID | providing the account — Art. 6(1)(b); security — Art. 6(1)(f) | until the account is deleted, or deleted after 3 years of inactivity, with an email notice beforehand; an account is inactive after 36 months without login, booking or account change; we notify you by email 30 days before deletion; if there is a future stay or an unsettled balance, the account is reviewed individually. Deletion at your request is separate and does not require inactivity. Deleting the account does not remove booking records that must be kept by law. Request deletion under “Request account deletion” in your account. |
| Newsletter | email, language, time and IP address of subscription, consent | consent — Art. 6(1)(a); Hungarian Act XLVIII of 2008, s. 6; establishing, exercising and defending legal claims — GDPR Art. 6(1)(f) | until consent is withdrawn. After you unsubscribe we send no marketing email and keep only what is needed to prove consent (subscription/unsubscription times, email and accepted consent text/version) for 5 years after unsubscribing. |
| Guest registration (VIZA) | surname and given name, birth name, place and date of birth, sex, nationality, mother’s birth name; from age 14 the ID document data; for third-country nationals visa/residence permit data; address of the accommodation, start and end of stay | legal obligation — Art. 6(1)(c), Act CLVI of 2016 s. 9/H; data stored encrypted only on the storage designated by the Government (Hungarian Tourism Agency), accessible to the authorities defined by law | at the Service Provider, in the property management software, until the data has been transmitted; in the VIZA storage until the last day of the first year after recording, then deleted (Section 9/H (3) and (5)) |
| Statistical reporting (NTAK) | statistical data defined by law (e.g. guest nights, price, payment method, country and postcode of residence, age data) — without name or contact details | legal obligation — Art. 6(1)(c), Government Decree 235/2019 (X. 15.) | the data sent to NTAK is generated by the property management software (SabeeApp) with the data set defined in Government Decree 235/2019 (X. 15.); retention of the booking data held in SabeeApp: as for booking data (5 years after the end of the stay) |
| Invoicing (Számlázz.hu, manual) | name, address, tax number, invoice items and amounts | legal obligation — Art. 6(1)(c), VAT Act, Accounting Act | 8 years (Accounting Act s. 169) |
| Tourist tax | guest nights, arrival/departure, date of birth (for exemption), tax paid | legal obligation — Art. 6(1)(c), Act C of 1990; Siófok decree 17/2022 | until the right to assess the tax lapses: 5 years from the last day of the year in which the return was due (Act CL of 2017 on the rules of taxation, Sections 78(3) and 202(1)) |
| Email correspondence | name, email, content | Art. 6(1)(b) or (f); establishing, exercising and defending legal claims — GDPR Art. 6(1)(f) | booking-related correspondence: same period as the booking; other correspondence: 1 year |
| Account deletion requests | account ID, email, time of request | legal obligation (GDPR Arts 12 and 17) — Art. 6(1)(c); establishing, exercising and defending legal claims — GDPR Art. 6(1)(f) | 5 years after the request was handled |
| Security and abuse prevention | hosting logs (IP, time, URL, browser); rate-limit counters using a one-way hash of the IP address | legitimate interest — Art. 6(1)(f) | counters for a few hours at most; hosting logs according to the system settings of the hosting provider (Sybell Informatika Kft.) |
| Statistics (Google Analytics 4) | visit data, pseudonymous identifier (_ga cookies) | consent — Art. 6(1)(a); Hungarian Act C of 2003, s. 155(4) | see Cookie Policy; never starts without consent |
| Google Maps | browser data, IP address (to Google) | consent — GDPR Art. 6(1)(a); Load map is informed consent to that map | per Google’s rules |
| Consumer complaints | name, contact details, complaint, minutes, evidence and reply | legal obligation — GDPR Article 6(1)(c), Act CLV of 1997, section 17/A(7) | complaint/minutes and copy of substantive reply: 3 years |
When a retention period ends, the data is deleted or anonymised. Where the law requires longer retention (e.g. accounting records), this applies only to the data concerned; in a documented dispute only the data needed for it is kept, until the dispute is closed. No automatic deletion runs: deletion is done manually and checked.
Copies of this data may also exist at our service providers (hosting, email delivery, invoicing, property management software) and in backups. These are deleted or overwritten as those services operate; we do not restore data from a backup once we have deleted it.
After performance, retention necessary to establish, exercise or defend legal claims relies on GDPR Article 6(1)(f), not continuing contractual performance. The legitimate interest is evidence of the booking, payment and settlement. The one-year retention of closed enquiries and other correspondence supports follow-up and handling claims. Limited evidence of consent and handling deletion requests is retained to demonstrate lawful conduct and defend claims. Security processing protects against unauthorised access and abuse. Unnecessary comments, identity-document data and technical data are not kept merely because core booking records have a longer period. You may object to processing based on legitimate interests.
Browser-cookie lifetime is different from server-side Google Analytics retention. Google deletes user-level and event-level Analytics data stored on its servers according to the data-retention period set in the Analytics account; aggregated reports are not affected.
3. Processors and recipients
| Provider | Task | Note |
|---|---|---|
| Sybell Informatika Kft., 1138 Budapest, Tomori utca 34. 2nd floor; company reg. no. 01-09-293034 | hosting of the website and its data | processor |
| Sendinblue SAS (Brevo), 9-17 rue Salneuve, 75017 Paris, France; RCS Paris 498 019 298 | email delivery (confirmations, notifications), newsletter list | processor, EU |
| Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (and Microsoft Corporation, USA) | the consumer Outlook.com mailbox patersiofok@hotmail.com: booking notifications, enquiries, cancellations and account-deletion requests arrive here, and correspondence with guests is handled from it | According to Microsoft’s privacy statement, Microsoft is a controller for this consumer service; no data processing agreement is available for this account type. Transfers to the USA are possible. |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Google Analytics 4 (consent only), Google Maps (consent or request only) | Analytics: processor; Maps: independent controller. Under Google’s data processing terms, transfers to the USA rely on a recognised framework (EU–US Data Privacy Framework) or standard contractual clauses. |
| KBOSS.hu Kft. (Számlázz.hu), 1031 Budapest, Záhony utca 7/D.; tax no. 13421739-2-41 | issuing invoices (manually; not connected to the website) | processor |
| thePass Kft. (operator of the SabeeApp software), 1053 Budapest, Reáltanoda utca 5. 4th floor; company reg. no. 01-09-172346; tax no. 24327567-2-41 | booking management, guest registration (VIZA) and NTAK reporting; not connected to the website | processor |
| Hungarian Tourism Agency | VIZA storage and NTAK | by law |
| Authorities | police (VIZA), municipal tax authority (tourist tax), NAV | by law, on request |
Booking data is stored in the website’s own booking engine; the website does not transfer data automatically to any other booking system.
4. Security
Access is limited to authorised persons who need the data for their duties. Access controls, encryption and backup measures are proportionate to processing risks. Passwords are stored as one-way hashes, not readable text.
5. Your rights
You may request access, rectification, erasure or restriction, object to processing based on legitimate interest, exercise data portability and withdraw consent at any time (without affecting earlier processing). Send requests to patersiofok@hotmail.com; we reply within one month (GDPR Art. 12).
Complaints: Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; ugyfelszolgalat@naih.hu; www.naih.hu. You may also go to court.
Rights apply subject to the GDPR conditions. Withdrawal of consent does not affect earlier lawful processing. You may object on grounds relating to your situation to processing based on legitimate interests; objections to direct marketing are unconditional. Legal obligations or legal claims may justify exceptions to erasure only for necessary data. Portability applies to automated processing based on consent or contract. We respond without undue delay and within one month; complex or numerous requests may require two additional months, with reasons notified within the first month. Identity checks, where needed, are proportionate. You may also complain to another competent EU supervisory authority. Missing mandatory data may prevent booking, invoicing or legally required check-in; marketing and optional-cookie consent are not conditions of accommodation.
6. Cookies
See the Cookie Policy.
7. Changes
We update this notice when our operations or the law change.