Privacy policy
Please read this Notice carefully to understand how we process your personal data. If you have any questions, please contact us at any of our contact details.
As a data controller, Zichy Üzemeltető Ltd. respects the privacy of all persons to whom personal data is disclosed and is committed to protecting it.
This notice applies to our customers, our employees working for our customers, visitors to our website, our hotel guests, our partners, our suppliers (and their potential suppliers) and employees of all of them.
Zichy Üzemeltető Kft. uses the assistance of an external partner to perform certain tasks in the course of its operations. In performing these tasks, it has a contractual relationship with the partners, which contracts cover the rules of data management. It has a joint data controller or data processor relationship with these partners, to which the guidelines of this data processing policy apply equally. For each processing operation, the name, address and contact details of that partner are indicated in this notice.
If you would like to request any action (transfer, deletion, rectification, etc.) in relation to your data processing, please contact us at any of our contact details.
I. Data controller's data
- Name: Zichy Üzemeltető Kft.
- Registered office: 7043 Bikács, Kistápé-Liget 633/3. hrsz.
- Phone: +36 30 523 6000
- Email: info@zichyelmenybirtok.hu
- Represented by: managing director Krisztián Balázs
II. Principles of data processing
II./1. Legality, fairness and transparency
II./2. Necessity and proportionality
II./3. Goal orientation
II./4. Data economy
II./5. Accuracy
II./6. Limited shelf life
II./7. Integrity and confidentiality
II/8. Accountability
II./1. Legality, fairness and transparency
Personal data must be processed lawfully and fairly and in a way that is transparent to you.
Lawfulness and fairness means that personal data are obtained by lawful and fair means at all times and that they are kept for the entire duration of the processing. It is also necessary that there is an adequate legal basis for the processing. The GDPR sets out a number of legal bases, 6 to be precise, on the basis of which we can process your data. These are consent, performance of a contract, legal obligation, vital interest, public interest and legitimate interest of the controller. You can read more about these legal grounds in the chapter on legal grounds for processing.
Transparency implies that the processing must always be carried out in such a way that you are aware of all the circumstances of the overall processing that affect you, such as what data we process, for what purpose, for how long, whether we transfer your data to someone else (e.g. an accountant), whether we transfer your data to a controller or processor operating in a country outside the European Union. Transparency implies that you have a right to know and we have an obligation to bring this to your attention.
It is important to know, however, that there are limits to the duty to inform. Information does not mean that we have to personally visit everyone whose data we process, but we must always be informed of the fact that data are being processed. There are various pieces of legislation and positions on how to provide information, for example, in some cases, for companies with a website, including ours, the appropriate information is the information on the website. But there are also strict cases where, for example, we are obliged to notify the data subject of a specific change in the processing by e-mail.
The GDPR also requires that if we receive your personal data from someone other than you, we must notify you as soon as possible, at the time of first contact, but no later than 1 month.
II./2. Necessity and proportionality
A fundamental right can only ever be restricted if it is necessary and proportionate. Necessity means that the processing is absolutely necessary for the purpose of the processing. Proportionality sets the framework for this necessity by ensuring that the restriction of fundamental rights and freedoms necessary for the processing is proportionate to the objective.
The Fundamental Law states that a fundamental right may be limited to the extent strictly necessary and proportionate to the aim pursued, while respecting the essential content of the fundamental right, in order to ensure the exercise of another fundamental right or to protect a constitutional value. We will always fully respect the principles of necessity and proportionality when processing your data.
II./3. Specificity of purpose
We will collect personal data only for specified, explicit and legitimate purposes and will not process it in a way incompatible with those purposes. In other words, we determine the purposes for which the data are processed prior to any processing and process the data only for those purposes. This purpose is never contrary to law. However, it is important to be aware that we may process data for more than one purpose, but in such cases we will always regulate the processing by purpose. For example, we may process your name for the purposes of requesting a quotation, later, when you become a customer, for the purposes of fulfillment, and then for billing purposes after the purchase. In these three cases, the purposes of data processing are clearly distinct, as we process your data for the purposes of preparing the contract when requesting a quotation, for the purposes of fulfilling the contract after the order is placed, and for the purposes of the legal obligation to invoice you after the order is placed.
But data processing can also be carried out for several purposes in parallel (e.g.: after the contract has been fulfilled, we may keep data in the form of documents for legitimate interest, for proof in a possible subsequent dispute, while the same data on the invoice are processed for legal data retention purposes.
You will always be informed if the purposes of the processing change.
Furthermore, further processing for archiving purposes in the public interest, scientific and historical research purposes or statistical purposes is not considered incompatible with the original purpose under the GDPR.
II./4. Data economy
We will keep the processing of personal data adequate, relevant and limited to what is necessary for the purposes for which it is processed. We will not process data that is not necessary for the purposes for which it is collected.
II./5. Accuracy
Personal data is kept accurate and up to date to the best of our knowledge. As far as possible, we will take all reasonable steps to promptly delete or rectify personal data that is inaccurate for the purposes for which it is processed. However, unrealistic things cannot be expected from a data controller. However, if we become aware that your data has been altered or incorrectly provided to us and this is not contrary to the purposes of the processing, it will need to be corrected and we will be notified of this.
We have a duty to strive for accuracy, but it is understood that if we become aware that we are mishandling your data, you should notify us.
II./6. Limited shelf life
The personal data will be stored in a form which permits identification of you only for the time necessary to achieve the purposes for which the personal data are processed. After that, the data will be deleted. Our information technology system is designed to ensure that electronically stored data is deleted within the time limit. The exact time of data storage and the rules for the disposal of data are regulated in our data management policy and we will act accordingly in all cases. Data will not be stored unnecessarily.
Your personal data will only be stored for longer than five years if the personal data are processed in accordance with the GDPR for archiving purposes in the public interest, scientific and historical research purposes or statistical purposes, subject to the implementation of appropriate technical and organisational measures to protect your rights.
II./7. Integrity and confidentiality
Your personal data will be processed in a manner that ensures adequate security of personal data, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage, by using appropriate technical or organisational measures. Data storage is designed to ensure that data cannot be accessed by unauthorised persons, even within the company.
II./8. Accountability
Zichy Üzemeltető Kft. is responsible for compliance with the data protection rules and is able to demonstrate such compliance. In Hungary, it is primarily the National Authority for Data Protection and Freedom of Information, or NAIH for short, that investigates whether the data processing of the company in question is lawful and complies with all legal requirements. In such an investigation, the data controller must be able to demonstrate and prove that it is processing its data in accordance with the law. An important part and way to do this is to have a data protection policy in place, which must regulate the processing lawfully and carry out the processing in accordance with it.
Zichy Üzemeltető Ltd. has developed a data management and data security policy for its entire data management process and manages its data in accordance with it.
III. Lawfulness of data processing
In designing our data management, we always take care to ensure that the processing of data is lawful in accordance with the principle of legality. Our processing is based on the following legal bases for processing, subject to the detailed rules highlighted below.
III./1. Consent of the data subject
III./2. Performance of the contract
III./3. Legal obligation
III./4. Vital interest
III./5. Public interest or exercise of public authority
III./6. Legitimate interest
III./1. Consent of the data subject
You have given your consent to the processing of your personal data for one or more specific purposes. It is important that your consent is voluntary and that you take an active part in giving it.
III./2. Performance of the contract
The processing is necessary for the performance of a contract to which you are a party or for taking steps at your request prior to entering into a contract.
III./3. Legal obligation
The processing is necessary to comply with a legal obligation to which we are subject. We will only process data on the basis of a legal obligation if we are legally obliged to do so. We do not use a legal obligation as a legal basis for processing where the law requires us to process data in a conditional way.
III./4. Vital interest
The processing is necessary to protect your vital interests or those of another natural person. An important criterion for the choice of the legal basis is that processing for vital interests must be temporary and only last for as long as the vital interest persists. The processing of data after the vital interest has ceased to exist is governed by specific rules.
III./5. Public interest or exercise of public authority
In this case, the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. We are not a public authority and we do not carry out processing for public interest purposes, so we do not currently process data under this legal basis.
III/6. Legitimate interest
The processing is necessary for the purposes of the legitimate interests pursued by Zichy Üzemeltető Kft. or by a third party, unless those interests are overridden by your interests or fundamental rights and freedoms which require the protection of personal data, in particular where a child is concerned.
We often use this legal basis for data processing.
In all cases of legitimate interest law-based processing, we have carried out an interest balancing test, assessing the proportionality and necessity of the impact and restriction on your fundamental rights and freedoms.
IV. Data security
Zichy Operating Ltd. is committed to protecting personal data against loss, unlawful use, unlawful disclosure, alteration, unavailability or destruction and will take all necessary measures to safeguard the confidentiality of personal data, including the use of appropriate technical and organisational measures.
Organisational measures include physical access control in our buildings, training of employees, locking paper files in appropriate rooms. Technical measures include encryption, password protection and the use of anti-virus software to access our systems.
As part of the process by which you provide us with your personal data, this data may also be transferred over the Internet. Although we will take all necessary measures to protect the personal data you provide to us, the transmission of data over the Internet cannot be considered completely secure. Accordingly, you should acknowledge and accept that we cannot take full responsibility for the security of any transmission of data through our website and that such transmission may be at your own risk. Once your personal data enters our systems, we will follow strict procedures to ensure security and prevent unauthorised access.
In cases where we have provided you with a password (or you have chosen one), you are responsible for maintaining the confidentiality of that password. We ask that you do not share this password with anyone.
From time to time, our websites and social media pages may contain links to websites operated by third parties, including those of our member companies and partner networks - new processing of these is not part of our activities.
V. Cookie management
V./1. What is a cookie?
V./2. Why do we use cookies?
V./3. What cookies do we use?
V./4. Cookie settings
V./5. Privacy information about cookies that provide basic functionality
A./1. What is a cookie?
A cookie is a small text file that is placed on your computer when you visit a website. Cookies have a number of functions, including collecting information, remembering user preferences, allowing the website owner to learn about user habits, and enhancing the user experience. You can manage your cookie preferences at any time in your browser settings.
A./2. Why do we use cookies?
- We use cookies to improve our sites
- Improve the user experience
- To help you manage our sites
- To obtain information on user habits
- Targeted advertising placement
A./3. What cookies do we use?
Cookies essential for the functioning of the site
Essential cookies help make our website usable by enabling basic features such as site navigation and access to secure areas of the website. The website cannot function properly without these cookies.
Cookies for setting purposes
Preferential cookies allow us to remember information that changes the way the website behaves or looks, for example, your preferred language or the region you are in.
Cookies for statistical purposes
By collecting and reporting data in an anonymous form, statistical cookies help the website owner to understand how visitors interact with the website.
Cookies for marketing purposes
Marketing cookies are used to track visitors' website activity. The aim is to serve relevant ads to individual users and encourage them to take action.
These cookies are used to serve relevant ads and content to groups of users. The process for this is done manually. These cookies are stored on your computer. Cookies are not used to identify individuals.
We also use remarketing services, such as Google Ads remarketing, to deliver our personalised ads to you. You can use these cookies to Google advertising settings in your browser by following the instructions there. About Google's privacy policy on advertising by clicking here to find out more.
V./4. Cookie settings
By default, all browsers allow the use of cookies. If you want to delete cookies from our pages or do not wish to use them, please refer to the links below, depending on the browser you are using:
Microsoft Internet Explorer 11
Microsoft Internet Explorer 10
Please note that if cookies are disabled, certain elements or the full functionality of the website may not be available.
V./5. Information on data management in relation to cookies
Purpose of the processing:
- For cookies essential for the functioning of the site: to ensure the proper functioning of the website.
- For other cookies: to improve our website, to facilitate navigation on our website and the use of its features to ensure a seamless user experience, to collect information about your use of our website, to serve targeted ads on other websites (remarketing), to track your activity on our website so that we can send you relevant offers that are of specific interest to you, to send you personalised offers to the contact details you provided when you registered.
Legal basis for processing:
- In the case of cookies essential for the functioning of the site: the legal basis for processing is Article 6(1)(f) of the GDPR - „processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party”.
- For other cookies: data subject consent - Article 6(1) GDPR the data subject has given his or her consent to the processing of his or her personal data for one or more specific purposes.
Demonstration of legitimate interest:
Without the cookies, the website cannot fully function in all its features and thus cannot achieve its purpose. On the other hand, the website needs to be protected against possible attacks. For this reason, the data controller has a compelling legitimate interest in recording the online identifier (IP address) of users who visit the website, which constitutes personal data, as well as other personal data generated in the context of browsing (time of browsing, browser type, some characteristics of the operating system of the device used for browsing, such as operating system type and language set), in order to prevent external attacks on the website and public electronic services. For this reason, the data controller operating the website has a legitimate interest in using cookies which are essential for its functioning.
Categories of persons concerned:
Natural persons visiting the website.
Categories of personal data:
The online identifier (IP address) of the users visiting the website, which is personal data, as well as other personal data generated in connection with browsing (time of browsing, browser type, some characteristics of the operating system of the device used for browsing, such as operating system type and language set).
The name of the cookie, the service provider, the purpose of the cookie, the type of cookie and the duration of the processing of the data for this purpose:
For more up-to-date information on this information, click on the cookie information at the bottom of the website.
Whether you are obliged to provide the personal data, the consequences of not doing so:
- For cookies that are essential for the site to work: yes. Without them, the site cannot be accessed and used properly.
- The other cookies do not have to be authorised.
Information on the fact of automated decision-making:
An automated decision-making process is likely to be implemented by the controller when processing data for this purpose.
VI. Individual processing
During our data management audit, we found that we process data in the following cases:
VI./1. Processing of data of information requesters, service enquirers, price requesters (by e-mail online, by post, by telephone, in person)
VI./2. Data processing related to the performance of contracts
VI./3. Processing of SMS and email notifications
VI./4. Billing and other accounting data processing
VI./5. Complaint data management
VI./6. Processing data of job applicants
VI./7. Dormant processing (statute of limitations)
VI./8. Processing of data from the hotel's on-site camera
VI./9. Processing for statistical purposes
VI./10. Data processing related to newsletters, marketing enquiries
VI./11. Data processing related to reservations (via e-mail, web reservation system)
VI./12. Data processing related to satisfaction measurement
VI./13. Processing of data related to social media interfaces
VI./1. Processing of data of information requesters, service enquirers, price requesters (by e-mail online, by post, by telephone, in person)
Purpose of the processing:
Answering potential clients' questions about contract performance, providing a quote in preparation for a subsequent contract.
Legal basis for processing:
GDPR Article 6(1)(b), 2nd indent: „necessary to take steps at the request of the data subject prior to the conclusion of the contract”.
Categories of persons concerned:
Information requesters, people interested in services, people asking for a quote.
Categories of personal data:
Name, e-mail address, telephone number.
The duration of the processing of the data for this purpose:
- Until revoked by the data subject.
- Until you reply to a request for information.
- In the case of a quotation, until the acceptance or rejection of the offer or until the offer expires.
Whether you are obliged to provide your personal data, and the consequences of not doing so:
- Not compulsory.
- We cannot contact you if your name is missing.
- We cannot notify you by e-mail if your e-mail address is missing.
- We cannot send you a quote if your e-mail address is missing.
- In the absence of a telephone number, we will not be able to call you back and arrange a personal meeting.
Recipients of personal data:
E-mail provider.
Whether there is a transfer to a third country or an international organisation:
Data transferred for this purpose will not be transferred to a third country or international organisation.
Information on the fact of automated decision-making:
No automatic decision-making is carried out in the processing of the data provided for this purpose.
VI./2. Data processing related to the performance of contracts
Purpose of the processing:
Entering into and performing contractual obligations, exercising contractual rights.
Legal basis for processing:
Performance of contracts - GDPR Article 6(2): „processing is necessary for the performance of a contract to which the data subject is a party or for the purposes of taking steps at the request of the data subject prior to entering into a contract”.
Categories of persons concerned:
Natural person contracting parties.
Categories of personal data:
Name, address, place and date of birth, mother's name, telephone number, e-mail address, other data specified in the contract.
The duration of the processing of the data for this purpose:
Until performance of the contract, or, in the event of termination of the contract for any reason, until the termination of the contract.
Whether you are obliged to provide your personal data, and the consequences of not doing so:
Yes. Without the data, the contract cannot be concluded.
Recipients of personal data:
- Accountant
- Post, courier service
- E-mail service provider, SMS service provider
- Other auxiliaries and subcontractors involved in the performance of the contract with prior information
Whether there is a transfer to a third country or an international organisation:
Data transferred for this purpose will not be transferred to a third country or international organisation.
Information on the fact of automated decision-making:
No automatic decision-making is carried out in the processing of the data provided for this purpose.
VI./3. Processing of SMS and e-mail notifications
Purpose of the processing:
At your request, we will inform you of your arrival time by SMS and/or e-mail the day before your arrival. The purpose of sending you this reminder is to ensure that you do not forget that you have a reservation for that date.
Legal basis for processing:
Performance of contracts - GDPR Article 6(1)(a): „the data subject has given his or her consent to the processing of his or her personal data for one or more specific purposes”.
Categories of persons concerned:
Data subjects with a reservation.
Categories of personal data:
Name, telephone number and/or e-mail address.
The duration of the processing of the data for this purpose:
Until cancellation, but not later than the date of the reservation.
Whether you are obliged to provide your personal data, and the consequences of not doing so:
- No.
- If you do not provide your phone number, we will not be able to contact you by SMS.
- If you do not provide your e-mail address, we will not be able to contact you by e-mail.
Recipients of personal data:
E-mail service provider, SMS service provider.
Whether there is a transfer to a third country or an international organisation:
Data transferred for this purpose will not be transferred to a third country or international organisation.
Information on the fact of automated decision-making:
No automatic decision-making is carried out in the processing of the data provided for this purpose.
VI./4. Billing and other accounting data management
Purpose of the processing:
Retention of accounting data to fulfil the obligation under the Accounting Act.
Legal basis for processing:
- The data controller processes billing and other accounting data lawfully under the GDPR because it has a legal obligation to do so. Legal obligation - Article 6(1)(c) GDPR: „processing is necessary for compliance with a legal obligation to which the controller is subject”.
- Act C of 2000 on Accounting - § 169 (1) - (6)
Categories of persons concerned:
Customers, other participants in the accounting process (e.g. actual payer).
Categories of personal data:
Name, address, other information required by law or provided at the request of the customer.
The duration of the processing of the data for this purpose:
As laid down by law, in principle for a period of 8 years.
Whether you are obliged to provide your personal data, and the consequences of not doing so:
Without mandatory data reporting, we cannot meet our legal obligations.
Recipients of personal data:
Accountants, audit authorities.
Data processing:
Our company's bookkeeping is carried out by an accountant within the framework of an employment contract. The employment contract also covers the rules for data processing. The accountant processes the personal data of the Data Subjects solely in accordance with the provisions of this Privacy Policy and is not entitled to disclose it to third parties.
Whether there is a transfer to a third country or an international organisation:
Data transferred for this purpose will not be transferred to a third country or international organisation.
Information on the fact of automated decision-making:
No automatic decision-making is carried out in the processing of the data provided for this purpose.
VI./5. Processing of complaints
Purpose of the processing:
Fulfilling legal obligations arising from warranty and guarantee claims, and handling other complaints.
Legal basis for processing:
- The controller processes it lawfully under the GDPR because it is legally obliged to do so. Legal obligation - Article 6(1)(c) GDPR: „processing is necessary for compliance with a legal obligation to which the controller is subject”.
- Act C of 2000 on Accounting - § 17/A (7): „The undertaking shall keep the record of the complaint and a copy of the reply for five years and shall present it to the supervisory authorities upon request.”
- The main rules on defective performance are set out in Chapter XXIV of the PTA, but other legislation may also provide for it.
Categories of persons concerned:
People with warranty and guarantee claims and other complaints.
Categories of personal data:
- Name, address - pursuant to the statutory obligation under Section 17/A (5) of Act CLV of 1997, the record of the complaint must contain the following information: the name and address of the consumer.
- Other data required by law and provided by the complainant may also be processed, of which the complainant will be informed in the complaint handling record.
The duration of the processing of the data for this purpose:
As laid down by law, in principle for a period of 5 years.
Whether you are obliged to provide your personal data, and the consequences of not doing so:
Without mandatory data provision, we cannot remedy your complaint and cannot comply with our legal obligations.
Recipients of personal data:
- E-mail service provider
- Mail and parcel delivery, courier service
- Authorities and courts
Whether there is a transfer to a third country or an international organisation:
Data transferred for this purpose will not be transferred to a third country or international organisation.
Information on the fact of automated decision-making:
No automatic decision-making is carried out in the processing of the data provided for this purpose.
VI./6. Processing of applicants' data
Purpose of the processing:
Applying for jobs, filling vacancies.
Legal basis for processing:
The data controller processes the data necessary for the preparation of a subsequent contract lawfully under the GDPR. Article 6(1)(b)(2) of the GDPR: „necessary to take steps at the request of the data subject prior to the conclusion of the contract”.
Categories of persons concerned:
Job applicants.
Categories of personal data:
- Name, telephone number and e-mail address for notification.
- Required information as specified in the job advertisement.
- Other information that the applicant provides voluntarily in addition to the conditions.
The duration of the processing of the data for this purpose:
Until the vacancy is filled or the job application is closed, but for a maximum of 3 months, or until withdrawal if the job is withdrawn by the data subject.
Recipients of personal data:
E-mail provider.
Whether you are obliged to provide your personal data, and the consequences of not doing so:
- No. Without the minimum information requested in the call for proposals, we cannot evaluate the application or notify you if we do not have the contact details.
- The voluntary provision of information is not compulsory and failure to provide it will not affect the application.
Whether there is a transfer to a third country or an international organisation:
Data transferred for this purpose will not be transferred to a third country or international organisation.
Information on the fact of automated decision-making:
No automatic decision-making is carried out in the processing of the data provided for this purpose.
VI./7. Dormant processing (statute of limitations)
Purpose of the processing:
Providing evidence in legal proceedings before public authorities and courts following performance of a contract.
Legal basis for processing:
The controller has a legitimate interest in the processing of the data following the performance of the contract, which is lawful. Legitimate interest - GDPR Article 6(1)(f): „processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party”.
The processing of a special category of personal data is lawful under Article 9(2)(f) of the GDPR where the processing is necessary for the establishment, exercise or defence of legal claims or where the courts are acting in their judicial role.
Demonstration of legitimate interest:
It is in the legitimate interest of the controller to be able to reconstruct the events in the course of official or judicial proceedings and to have adequate means of proof.
We have applied a legitimate interest balancing test to determine that the legitimate interest of Zichy Üzemeltető Kft. does not disproportionately restrict your rights and freedoms.
Categories of persons concerned:
Private parties to a contract, representatives of non-private parties to a contract, their authorised representatives, contact persons.
Categories of personal data:
- Name, address, place and date of birth, mother's name, e-mail, telephone number, postal address.
- Other data provided for the purpose of performance and necessary for the validation of the claim, which may include specific health data.
The duration of the processing of the data for this purpose:
Until the expiry of the limitation period, in principle 5 years.
Pursuant to Section 6:22 (1) of the PTK, the limitation period is 5 years after the performance of the contract or the termination of the contract without performance for any reason, or, if another limitation period is provided by law, until the limitation period. We will only retain other data that we obtain if it is relevant to the merits of the case or to subsequent proof of the acts.
Whether you are obliged to provide your personal data, and the consequences of not doing so:
Yes. We cannot conclude the contract if the data is not provided.
Recipients of personal data:
- E-mail service provider
- Authorities and courts
- Legal representative
Whether there is a transfer to a third country or an international organisation:
Data transferred for this purpose will not be transferred to a third country or international organisation.
Information on the fact of automated decision-making:
No automatic decision-making is carried out in the processing of the data provided for this purpose.
VI./8. Processing of data from the hotel's camera
Purpose of the processing:
To make the hotel area of the Zichy Family Experience Estate operated by Zichy Üzemeltető Kft. safer for the protection of life, limb and property.
Legal basis for processing:
The data controller has a legitimate interest in the use of the cameras, which is lawful. Legitimate interest - Article 6(1)(f) GDPR: „processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party”.
Demonstration of legitimate interest:
Zichy Üzemeltető Ltd. uses the camera surveillance system in the hotel area for the protection of human life, physical safety and property.
Categories of persons concerned:
Persons and employees entering the hotel premises.
Categories of personal data:
The portrait of the persons concerned.
The duration of the processing of the data for this purpose:
Images are kept for 30 working days, after which they are deleted. If the hotel is closed for more than 1 business day, the retention period will be until the end of the business day following opening.
Whether you are obliged to provide your personal data, and the consequences of not doing so:
Yes. You will not be able to visit our hotel if you do not provide this information.
Recipients of personal data:
Authorities, court.
Whether there is a transfer to a third country or an international organisation:
Data transferred for this purpose will not be transferred to a third country or international organisation.
Information on the fact of automated decision-making:
No automatic decision-making is carried out in the processing of the data provided for this purpose.
VI./9. Processing for statistical purposes
The data controller shall carry out processing for statistical purposes only in a way that does not permit identification.
VI./10. Data processing related to newsletters, marketing enquiries
Purpose of the processing:
Informing potential customers about current hotel offers and promotions.
Legal basis for processing:
Article 6(1)(a) GDPR: consent of the data subject.
Categories of persons concerned:
Newsletter subscribers.
Categories of personal data:
Name, e-mail address, telephone number.
The duration of the processing of the data for this purpose:
Until revoked by the data subject.
Whether you are obliged to provide your personal data, and the consequences of not doing so:
Not compulsory.
- We cannot contact you if your name is missing.
- If you do not have an e-mail address, we will not be able to notify you by e-mail about promotions and current offers.
- We cannot send you a quote if your e-mail address is missing.
- In the absence of a telephone number, we will not be able to call you back and arrange a personal meeting.
Recipients of personal data:
E-mail service provider, joint data controller, data processor.
Data processor 1:
Our company uses the assistance of an IT service provider to send the newsletter as follows:
- Data processor name: Previo.hu Kft.
- Head office: 1119 Budapest, Petzvál József u. 4/A
- Tax number: 27786330-2-43
- Web: https://www.previo.hu/
Data processing tasks:
Storage of the newsletter database.
Data processor 2:
Our company uses the help of an IT service provider to use marketing communication messages and marketing automation. By accepting this Privacy Policy, the data subject gives his/her explicit consent to the use of a data processor by the Data Processor, in order to make the service more convenient and customized, as follows:
- Data processor name: Dynex Kft.
- Office: 1238 Budapest, Hősök Tere 37.
- Tax number: 32722510-2-43
- Web: https://dynex.hu/
Whether there is a transfer to a third country or an international organisation:
Data transferred for this purpose will not be transferred to a third country or international organisation.
Information on the fact of automated decision-making:
No automatic decision-making is carried out in the processing of the data provided for this purpose.
VI./11. Reservation-related data processing (via e-mail and web booking system)
We offer online booking in order to book a room at the Zichy Family Experience Farm quickly, conveniently and free of charge.
Purpose of the processing:
To make booking accommodation easier, cheaper and more efficient.
Legal basis for processing:
Prior consent of the person booking the accommodation.
Categories of persons concerned:
A natural person booking accommodation.
Categories of personal data:
Name, address, e-mail address, telephone number, bank card number, SZÉP card details, identity document details (document number, nationality, date of birth, name, address), vehicle registration number.
The duration of the processing of the data for this purpose:
The reservation is made according to the last day of the stay after 2 years.
Whether you are obliged to provide your personal data, and the consequences of not doing so:
No contract for the hotel room.
Recipients of personal data:
Data processor.
We use the services of an IT service provider to operate our online hotel reservation system as follows:
- Data processor name: Previo.hu Kft.
- Head office: 1119 Budapest, Petzvál József u. 4/A
- Tax number: 27786330-2-43
- Web: https://www.previo.hu/
Data processing tasks:
Providing the possibility of online booking module through the Previo hotel management system, pre-arrival e-mail module.
By accepting this Privacy Notice, the data subject explicitly consents to the use of additional processors by the Processor, in order to make the service more convenient and customized, as follows.
Name of data processor | Headquarters | Description of a data processing job |
Previo.hu Kft. | 1119 Budapest, Petzvál József u. 4/A | Performing customer management tasks when using the Front Office hotel system. |
Novopayment Ltd. | 1034 Budapest, Tímár u. 20. | Handling the data communication required for payment transactions between the merchant and the payment service provider's system, ensuring the traceability of transactions for merchant partners. |
OTP Mobil Kft. | 1093 Budapest, Közraktár u. 30-32. | Handling the data communication between the merchant's system and the payment service provider's system for payment transactions, providing customer service assistance to users, confirming transactions and fraud monitoring to protect users. |
PG Info Service Ltd. | 9141 Ikrény, Sport utca 22.
| The Group setting up and operating your business management system, programming data transmission integrations |
Barion Payment Zrt. | 1117 Budapest, Infopark sétány 1. building I. | Handling the data communication between the merchant's system and the payment service provider's system for payment transactions, providing customer service assistance to users, confirming transactions and fraud monitoring to protect users. |
Name of data processor | Headquarters | Performing server hosting tasks |
Previo.hu Kft. | 1119 Budapest, Petzvál József u. 4/A | Owner of the software integrated into the reservation system. This software is responsible for sending automatic emails with confirmations, notifications for reservations, requests for quotations, offers, pre-arrival emails, gift voucher sales and satisfaction surveys. |
Previo.hu Kft. | 1119 Budapest, Petzvál József u. 4/A | Channel manager for managing prices and availability in one place when using multiple sales channels. |
Name of data processor | Headquarters | Web hosting tasks |
Outsourced Marketing Ltd. | 2636 Tésa, Petőfi utca 16. | Website maintenance, web support, web hosting management, backup |
VI./12. Personal data processing in relation to satisfaction measurement
As a hotel, our aim is to provide our guests with a high quality of service, so we constantly ask for feedback from our guests about their experience of staying at our hotel.
Purpose of the processing:
Request feedback from our guests to further develop and improve our services.
Legal basis for processing:
The hotel operator has a legitimate interest- Article 6(1)(f) GDPR.
Indication of legitimate interest:
We have a legitimate interest in receiving feedback to help us improve our services.
Categories of persons concerned:
A natural person booking accommodation.
Categories of personal data:
Name, gender, e-mail address.
The duration of the processing of the data for this purpose:
The reservation is made according to the last day of the stay after 2 years.
Whether you are obliged to provide your personal data, and the consequences of not doing so:
No. The person concerned does not receive a satisfaction questionnaire from our company.
Use of a data processor:
We use IT service providers for our online accommodation system and marketing automation system as follows:
Name of data processor | Headquarters | Description of a data processing job |
Previo.hu Kft. | 1119 Budapest, Petzvál József u. 4/A | How to operate the satisfaction measurement module |
Dynex Ltd. | 1238 Budapest, Hősök Tere 37. | A platform for building marketing automations linked to the customer database* |
*Due to the fact that Dynex's system is connected to international sub-processors, some of which (e.g. Vercel, LeadConnector, OpenAI) are based in the United States of America, data is transferred outside the European Economic Area (EEA).
The legal basis for these data transfers is primarily provided by the EU-US Data Privacy Framework (DPF) Compliance Decision adopted by the European Commission. In cases where the DPF is not applicable, the Service Provider will apply the Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by the necessary technical safeguards.
VI./13. Data processing related to the use of social media platforms
Zichy Üzemeltető Ltd. uses the following social media platforms: https://www.facebook.com/ZichyCsaladiElmenybirtok
https://www.instagram.com/zichycsaladielmenybirtok
We would like to draw your attention to the fact that, in addition to our Company, the operator of our social media platforms is also the data controller, and you are also processing data. In most cases, we have no control over the operator's activities, but where we can, we will facilitate the processing of data in a manner that is appropriate from a data management perspective.
The information you provide on our social media platforms (links, images, comments, videos, news) is made public and available by the platform and will not be used by our Company for any other purpose. Where applicable, we will share your content on our own platforms (Share button), if the platform provides the possibility to do so.
Purpose of the processing:
Promoting our communication activities.
Legal basis for processing:
The hotel operator has a legitimate interest- Article 6(1)(f) GDPR: to facilitate communication.
Categories of persons concerned:
Any natural person active on a social media platform.
Categories of personal data:
Links, pictures, videos, comments, profile name.
For more information about the operator's data processing and how to object to data processing, please see the privacy policy of the service providers below:
Facebook: https://www.facebook.com/privacy/explanation
Instagram: https://help.instagram.com/E19E2212E10787E
VII. Your rights
If you would like to exercise any of the above rights (request the transfer, deletion, rectification, etc. of your data), please contact us at any of our contact details. You have the following rights:
VII./1. The right to information
VII./2. Right of access
VII./3. Right to rectification
VII./4. Right to erasure
VII./5. Right to restriction
VII./6. Right to data portability
VII./7. The right to object
VII./1. The right to information
We are required to provide information of an appropriate size, in an appropriate language, in plain language and easy to find about the relevant aspects of data processing (what, what for, how, from when to when, etc.) - and the GDPR sets out exactly what information is required. The information should preferably be provided before the personal data are collected. If this is not possible - for example, because the data is obtained from a third party - it should be done at the earliest possible time.
You can read about the right to information in Articles 13-14 of the GDPR.
VII./2. Right of access
You may request information about whether and under what conditions your data is processed and, if so, which data and under what conditions. The conditions that can be requested are also detailed in the right to information above.
You can read about the right of access in Article 1E of the GDPR.
VII./3. Right to rectification
You may notify us that the data we are processing is inaccurate and request that it be replaced by us. If you become aware that your data is inaccurate or incorrect, please let us know as soon as possible and we will correct it.
You can read about the right to rectification in Articles 16 and 19 of the GDPR.
VII./4. Right to erasure
You may request that we delete your data from the database in the cases and under the conditions specified by law. Such cases include, for example, if the personal data are no longer necessary for the purposes for which they were collected or otherwise processed, or if you withdraw your consent and there is no other legal basis for the processing.
Unfortunately, however, there are cases where we have to refuse to delete that data. One of these cases is where we are legally obliged to keep the data (for example, data used for invoicing purposes must, as a general rule, be kept for 8 years in accordance with the relevant legislation), but we may also refuse to delete the data within the limitation period on the grounds of legitimate interest, for example, because of a subsequent proof. And, of course, beyond these examples, there are many cases where data processing against an objection is lawful.
As in data protection in general, each case is unique and must be considered on its own merits to determine whether it is lawful to refuse to erase the data.
You can read about the right to erasure in Articles 17 and 19 of the GDPR.
VII./5. Right to restriction
You may request that we limit the processing of your data for a limited period of time (even by law) in the cases and under the conditions set out in the law. Restricted data may, subject to exceptions provided for by law, only be stored and may not be otherwise processed. If the restriction is lifted, we will notify you.
You can request a restriction in the following cases:
- You contest the accuracy of the personal data, in which case the restriction applies for the period of time that allows the accuracy of the personal data to be verified.
- If the processing is unlawful but you object to the deletion of the data, you can instead request the restriction of their use.
- The data controller no longer needs the personal data for processing purposes, but you require them for legal proceedings.
- You have objected to the processing, in which case the restriction applies for the period until it is established whether the controller's legitimate grounds prevail over your legitimate grounds.
You can read about the right to restriction in Articles 18 and 19 of the GDPR.
VII./6. Right to data portability
You can request to receive the data processed about you in a structured, commonly used, machine-readable format (e.g. .doc, .pdf, etc.) and you have the right to transfer this data to another controller without hindrance from the original controller. In other words, the GDPR set of rules makes it easier for a data subject to transfer his or her personal data from one controller to another. But this is only possible if the processing is automated.
You can read about the right to data portability in Article 20 of the GDPR.
VII/7 Right to object
You have the right to object to processing in certain cases. If you object, we may not process your personal data unless there are compelling legitimate grounds for doing so which override your interests, rights and freedoms or for the purposes of possible legal claims, administrative or judicial proceedings.
In certain cases, you have the right to ask for automatic decision-making not to apply to you. This is primarily on the condition that it is not necessary for the conclusion or performance of a contract between you and us and that automatic decision-making is not required by law in the particular case.
You can read about the right to object and automatic decision-making in Articles 21-22 of the GDPR.
VIII. Where can you go for redress?
First of all, contact us with confidence, we will definitely try to solve your problem! If this does not work, or if you do not want it to, you can contact the data protection authority or file a complaint with the courts.
Contact details of the Hungarian Data Protection Supervisory Authority:
- National Authority for Data Protection and Freedom of Information
- Postal address: 1363 Budapest, Pf.: 9.
- Address: 1055 Budapest, Falk Miksa utca 9-11.
- Phone: +36 (1) 391-1400
- E-mail: ugyfelszolgalat@naih.hu
- Website: https://naih.hu/
The right to apply to the courts:
You can also take the controller to court if your data subject rights are infringed. You may also bring the action before the court of your choice, in the place where you reside or stay.
IX. Validity of these rules
These rules are in force from 1 May 2026 until they are repealed.