Woodhouses Noszvaj (House Of Life Kft.; Tax number: 27764646-2-10, NTAK registration number: EG22035061; hereinafter referred to as the “Service Provider” or “Data Controller”) acknowledges the contents of this Privacy Policy as binding upon itself.
The Service Provider undertakes to ensure that the processing of personal data related to its services and the operation of the accommodation complies with the provisions of this Privacy Policy and the applicable legislation.
This Privacy Policy applies to the processing of personal data carried out on the Service Provider’s website (www.woodhouses.hu) and its subdomains.
This Privacy Policy is continuously available on the above-mentioned website.
The Service Provider’s data processing principles are in accordance with the applicable data protection legislation, in particular:
Any identified or identifiable natural person who can be identified, directly or indirectly, on the basis of personal data.
Any information relating to an identified or identifiable natural person, including in particular the person’s name, identification number, or one or more characteristics specific to their physical, physiological, mental, economic, cultural or social identity, as well as conclusions that can be drawn from such data concerning the individual.
a) Personal data revealing racial or ethnic origin, nationality, political opinions or political affiliation, religious or philosophical beliefs, membership of an interest-representation organisation, or information concerning sexual life;
b) Personal data relating to health, addiction or criminal offences.
A voluntary and specific expression of the Data Subject’s wishes, based on appropriate information, by which the Data Subject gives their unambiguous consent to the processing of their personal data, either in full or for specific processing operations.
A declaration by the Data Subject objecting to the processing of their personal data and requesting the termination of the processing and/or deletion of the processed data.
The natural or legal person or organisation without legal personality which, alone or jointly with others, determines the purposes and means of processing personal data, makes decisions concerning the processing of data, including the means used, and implements such decisions itself or through a Data Processor appointed by it.
Any operation or set of operations performed on personal data, regardless of the procedure used, including in particular the collection, recording, organisation, storage, alteration, use, retrieval, transmission, disclosure, coordination or combination, blocking, deletion or destruction of data, as well as preventing further use of data.
Data processing also includes the creation of photographs, audio recordings or video recordings, as well as the recording of physical characteristics suitable for identifying an individual, such as fingerprints, palm prints, DNA samples or iris images.
Making data available to a specified third party.
Making data available to any person.
Rendering data unrecognisable in such a way that it can no longer be restored.
Adding an identifying mark to data for the purpose of distinguishing it from other data.
Adding an identifying mark to data for the purpose of permanently or temporarily restricting its further processing.
The complete physical destruction of the data medium containing the data.
The performance of technical tasks related to data processing operations, regardless of the method, means or location used to carry out such operations, provided that the technical tasks are performed on the data.
A natural or legal person or organisation without legal personality which processes personal data on the basis of an agreement with the Data Controller, including an agreement concluded pursuant to statutory provisions.
A public authority or body that has generated data of public interest required to be published electronically, or in whose operation such data was generated.
A public authority or body which, where the Data Custodian does not publish the data itself, publishes on its website the data provided to it by the Data Custodian.
The entirety of data processed within a single register.
Any natural or legal person or organisation without legal personality other than the Data Subject, Data Controller or Data Processor.
Any communication, information or presentation intended to promote the sale or other use of a product, service, real estate or a right of economic value, or, in connection with such purposes, to promote the name, designation or activities of an undertaking or increase awareness of a product or trademark.
Personal data may only be processed for a specified purpose, for the exercise of a right or fulfilment of an obligation.
At every stage of processing, the processing must comply with its stated purpose, and the collection and processing of personal data must be fair and lawful.
Only personal data that is essential for achieving the purpose of the processing and suitable for achieving that purpose may be processed.
Personal data may only be processed to the extent and for the period necessary to fulfil the purpose.
Personal data may be processed where the Data Subject has given consent, or where processing is required by law or, within the scope authorised by law, by a local government regulation for a purpose based on the public interest.
Where the Data Subject is unable to provide consent due to incapacity or another unavoidable reason, their personal data may be processed, to the extent necessary to protect the vital interests of the Data Subject or another person or to prevent or eliminate an immediate threat to the life, physical integrity or property of persons, for as long as the circumstances preventing consent exist.
The consent of a minor who has reached the age of 16 shall be valid without the consent or subsequent approval of their legal representative.
Where the purpose of processing based on consent is the performance of a contract concluded in writing with the Data Controller, the contract must contain all information that the Data Subject must be aware of in relation to the processing of personal data under the applicable legislation.
This includes, in particular, the categories of data processed, the duration and purpose of processing, the fact and recipients of any data transfers and the use of a Data Processor.
The contract must clearly state that by signing it, the Data Subject consents to the processing of their data as specified in the contract.
Consent shall be deemed to have been given in respect of personal data disclosed by the Data Subject during a public appearance or voluntarily provided by the Data Subject for publication.
In case of doubt, it shall be presumed that the Data Subject has not given consent.
The legal basis for data processing on the website is the User’s consent, Section 5(1) of the Infotv., and Section 13/A(3) of Act CVIII of 2001 on Electronic Commerce and Information Society Services.
The following personal data may be processed:
When checking in at the accommodation, the following additional information may be required:
The following information can be modified through the website:
Personal data is deleted immediately upon deletion of the registration.
Accounting documents are retained by the Service Provider for 8 years, in accordance with Section 169(2) of Act C of 2000 on Accounting.
Requests for the modification or deletion of personal data may also be submitted:
By email: hello@woodhouses.hu
Courts, prosecutors, investigative authorities, administrative authorities, the National Authority for Data Protection and Freedom of Information, and other authorities authorised by law may request information or personal data from the Service Provider.
Where an authority has specified the exact purpose and scope of the requested data, the Service Provider shall disclose only the amount and type of personal data that is strictly necessary to fulfil the purpose of the request and/or that is available to the Service Provider at the time of the request.
The Service Provider processes personal data and information provided by Data Subjects and necessary for the provision of the services in accordance with Act CXII of 2011 on Informational Self-Determination and Freedom of Information and the relevant provisions of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, concluded in Strasbourg on 28 January 1981.
The Service Provider uses processed data exclusively in a form that does not allow the personal identification of individuals.
The Service Provider processes Users’ personal data for the purpose of providing its services, including sending newsletters and completing accommodation check-in procedures, and only to the extent and for the period necessary for these purposes.
Data processing shall comply with these purposes at every stage.
The Service Provider also processes personal data that is technically indispensable for providing the services.
Where personal data has been collected with the User’s consent, the Service Provider may, unless otherwise provided by law, continue to process the data without obtaining separate additional consent, including after withdrawal of consent:
a) for the purpose of fulfilling a legal obligation applicable to the Service Provider; or
b) for the purposes of enforcing the legitimate interest of the Service Provider or a third party, provided that such interest is proportionate to the restriction of the Data Subject’s right to the protection of personal data.
The Service Provider may transfer personal data processed by it to third parties.
The Municipality of Noszvaj may request booking data from the Service Provider at any time for the purposes of submitting the relevant HIFA declaration.
In all other cases, the data appears only in statistical form in the system of the National Tax and Customs Administration (NAV).
The Service Provider shall not misuse personal data processed by it in any way.
Cookies commonly used on websites include password-protected session cookies, shopping-cart cookies and security cookies. The use of such cookies does not require prior consent from the Data Subject.
Consent is not required where cookies are used exclusively for transmitting communications over an electronic communications network or where their use is strictly necessary for the Service Provider to provide an information society service explicitly requested by the subscriber or User.
For session cookies, the processing period lasts until the User finishes browsing the website.
The purpose of processing is to identify Users and monitor website visits.
The websites may contain links to external servers or websites not operated by the Service Provider.
Websites accessible through such links may place their own cookies or other files on the User’s device, collect data or request personal information.
The Service Provider accepts no responsibility for the data processing practices of such external websites.
The Service Provider uses Google Analytics to measure website traffic.
The website contains code associated with the Google Analytics service, which transmits statistical information relating to individual visits to an external server operated by the Service Provider’s service provider.
The transmitted information does not allow the Data Subject to be identified exclusively.
Further information regarding Google Analytics’ privacy principles is available here:
Google Analytics Terms of Service
Cookies are stored on the User’s device.
Users can delete cookies through the Tools/Settings menu of their web browser, under the relevant Privacy settings.
By using the Service, the User consents to the Service Provider collecting and processing their personal data as described in this Privacy Policy for the purpose of providing the services in full.
In accordance with Section 6 of Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities, the User gives their prior and explicit consent to being contacted by the Service Provider with promotional offers and other communications using the contact details provided during registration, such as their email address or telephone number.
The Customer also consents, subject to the provisions of this Privacy Policy, to the processing of the personal data necessary for sending promotional offers.
The Service Provider does not send unsolicited marketing messages.
Users may unsubscribe from promotional communications free of charge and without restriction or justification.
Upon unsubscribing, the Service Provider shall delete from its records all personal data necessary for sending marketing communications and shall no longer contact the User with promotional offers.
Users may unsubscribe by clicking the unsubscribe link contained in the relevant message.
The legal basis for processing is the Data Subject’s voluntary consent, Section 5(1) of the Infotv., and Section 6(5) of Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities.
processed through the Mailchimp system.
Personal data is retained until the consent is withdrawn, i.e. until the User unsubscribes.
The purpose is to send electronic marketing communications to the Data Subject and provide information about current news, products, promotions, new features and other relevant information.
The legal basis for processing is the Data Subject’s consent to the processing of their personal data on Facebook.com.
Information regarding the source of the data, its processing, the manner in which it is transferred and its legal basis is available at:
The purpose of processing is to enable Users to share or like certain content, products, promotions or the website itself on Facebook.com.
Data processing takes place on Facebook.com. Therefore, the duration and method of processing, as well as the options for deleting and modifying data, are governed by Facebook’s applicable policies:
Facebook: facebook.com/woodhousesnoszvaj
Instagram: instagram.com/woodhousesnoszvaj
The legal basis for processing is the Data Subject’s consent to the processing of personal data on the Woodhouses website/property.
The purpose of the camera system is to protect the property located at Noszvaj, Várkút utca 2, prevent unauthorised entry and identify unauthorised persons on the property.
The property is monitored by 3 security cameras installed in the outdoor areas of the premises.
The cameras record footage of the outdoor areas of the property at Noszvaj, Várkút utca 2.
Recordings are retained for 30 days and operate continuously on a 24-hour recording basis.
The recordings are stored on a dedicated server and processed electronically.
The duration, method and conditions of processing, as well as the deletion and modification of data, are governed by the applicable general regulations.
The recording system may only be disabled on the basis of an individual agreement.
In all other cases, 24-hour video recording is carried out.
There are no security cameras inside the apartments/accommodation units.
The Service Provider takes all necessary security, organisational and technical measures to ensure the highest possible level of security for personal data and to prevent its unauthorised alteration, destruction or use.
The Service Provider takes all necessary measures to ensure data integrity, including the accuracy, completeness and up-to-date status of the personal data processed and/or handled by it.
The Service Provider also ensures that the integrity of the data can be verified.
The Service Provider protects personal data through appropriate measures against, in particular:
The Service Provider takes all reasonable measures to preserve the authenticity and confidentiality of the processed data and to ensure that the Data Subjects and authorised persons can access the data whenever necessary.
If the Service Provider identifies a security vulnerability in its system originating from its customers or partners, it reserves the right to notify the affected customers and partners.
At the same time, until the vulnerability has been resolved, the Service Provider may restrict access to its systems or services, or to certain functions thereof.
The Data Subject may request the Service Provider to provide information about the processing of their personal data.
The Data Subject may also request the correction of their personal data and, except where processing is mandatory, request the deletion or blocking of their personal data.
Upon request by the User, the Service Provider shall provide information about:
The Service Provider shall provide this information in writing and in an understandable form as soon as possible, but no later than 30 days after submission of the request.
The provision of such information is free of charge.
If personal data is inaccurate and accurate personal data is available to the Data Controller, the Service Provider shall rectify the inaccurate data.
Instead of deleting personal data, the Service Provider shall block the data if requested by the User or if, based on the available information, it can reasonably be assumed that deletion would harm the User’s legitimate interests.
Blocked personal data may only be processed for as long as the purpose that prevented its deletion continues to exist.
The Service Provider shall delete personal data if:
The Service Provider shall notify the Data Subject of any rectification, blocking, marking or deletion and shall also notify all persons to whom the data was previously transferred for processing purposes.
Such notification may be omitted if, in view of the purpose of the processing, it does not infringe the legitimate interests of the Data Subject.
The Data Controller has 30 days to process requests for the deletion, blocking or rectification of personal data.
If the Service Provider refuses a request for rectification, blocking or deletion, it shall provide the User with the reasons for the refusal in writing within 30 days.
The User may object to the processing of their personal data if:
a) the processing or transfer of personal data is necessary solely for the fulfilment of a legal obligation applicable to the Service Provider or for the enforcement of the legitimate interest of the Service Provider, the recipient of the data or a third party, except where processing is required by law;
b) the personal data is used or transferred for the purposes of direct marketing, public opinion research or scientific research;
c) in any other case specified by law.
The Service Provider shall investigate the objection as soon as possible, but no later than 15 days after submission of the request, make a decision regarding its validity and notify the applicant of its decision in writing.
If the Service Provider determines that the objection is justified, it shall terminate the processing, including any further collection or transfer of data, and block the data.
The Service Provider shall also notify all persons to whom the personal data concerned by the objection was previously transferred. Such persons shall take the necessary measures to ensure the exercise of the right to object.
If the User disagrees with the decision made by the Service Provider, they may bring legal proceedings before a court within 30 days of receiving the decision.
In the event of a violation of their rights, the User may bring legal proceedings against the Service Provider before a court.