Privacy policy

This policy explains what personal data we process about you, why, for how long, and who can access it. It has been prepared under the EU General Data Protection Regulation (GDPR – Regulation (EU) 2016/679) and Hungarian Act CXII of 2011 on informational self-determination.

1. Controller

Controller (we)	Kabin Project Korlátolt Felelősségű Társaság (Kabin Project Kft.)
Registered address	Komáromi utca 9/A., 2016 Leányfalu, Hungary
Branch	Zártkert 1151/7., 3346 Bélapátfalva, Hungary
Company registration no.	13-09-219975
Tax number	27835953-2-13
Property	NORTE – House by the Cliff, Eldűlő utca 1., 3346 Bélapátfalva, Hungary
Email / phone	[email protected] · +36 30 498 7074

We are not required to appoint a data protection officer. For any data protection question, contact us at the email address above.

2. What data we process and why

2.1. Booking and providing the accommodation

Data	name, email, phone number, address (country, postcode, city, street), arrival and departure dates, number of guests, comments; for company bookings, company name and tax number
Purpose	creating and confirming the booking, arranging arrival and key handover, staying in touch during your stay
Legal basis	performance of a contract and pre-contractual steps – GDPR Art. 6(1)(b)
Retention	until claims under the contract expire: 5 years after departure

Providing this data is required for the booking. Without it, we can’t fulfil the booking.

2.2. Payment

Data	amount, date, transaction ID and status; for SZÉP card payments, the cardholder’s name and card identifiers
Purpose	payment of the accommodation fee (advance)
Legal basis	performance of a contract – GDPR Art. 6(1)(b)
Retention	as set out in 2.1 and 2.3

Card payments are processed by Stripe. We never see or store your full card number or security code.

2.3. Invoicing and accounting

Data	billing name, address, (for companies) tax number, service, amount, invoice date
Purpose	issuing invoices and keeping accounting records
Legal basis	legal obligation – GDPR Art. 6(1)(c), Hungarian Accounting Act (Act C of 2000) Section 169 and VAT Act (Act CXXVII of 2007)
Retention	8 years

2.4. Guest register – VIZA

Data	surname and given names, birth names, place and date of birth, sex, nationality, mother’s birth name, identity or travel document details, for third-country nationals the visa or residence permit number and the date and place of entry, the Property’s address, start and expected end of the stay
Purpose	the guest registration obligation under Hungarian Act CLVI of 2016 on tourism development; protecting personal and public safety
Legal basis	legal obligation – GDPR Art. 6(1)(c), Act CLVI of 2016 Section 9/H
Retention	as required by law. The property management software transmits the data in encrypted form to the Guest Information Closed Database (VIZA), which only authorities designated by law can access.

Presenting an identity document is a legal condition of staying at the Property.

2.5. Tourist tax and statistical reporting

Data	guest name, number of guest nights, tourist tax amount, the basis of any exemption and the data needed to prove it (e.g. date of birth for under-18s)
Purpose	assessing and declaring tourist tax; mandatory tourism statistics reporting (NTAK)
Legal basis	legal obligation – GDPR Art. 6(1)(c), Hungarian Local Taxes Act (Act C of 1990) Sections 30–31, Act CLVI of 2016 and Government Decree 235/2019 (X.15.)
Retention	until the right to assess the tax expires (5 years from the end of the tax year)

The property management software only sends statistical data to the National Tourism Data Service Center (NTAK) from which guests cannot be identified.

2.6. Contact and enquiries

Data	name, email, phone number, message content (email, phone, Instagram or Facebook message)
Purpose	answering questions, sending offers, arranging single-night bookings
Legal basis	pre-contractual steps – GDPR Art. 6(1)(b), or our legitimate interest in responding to enquiries – GDPR Art. 6(1)(f)
Retention	if no booking is made, 1 year after the conversation ends

2.7. Complaints

Data	name, contact details, subject and description of the complaint, the record of the complaint and our reply
Purpose	investigating and responding to complaints
Legal basis	legal obligation – GDPR Art. 6(1)(c), Hungarian Consumer Protection Act (Act CLV of 1997) Section 17/A
Retention	for the period required by consumer protection law

2.8. Using the website

We use Google Analytics 4 for analytics and advertising purposes (see section 2.9), which you can switch off at any time via the Turn off analytics link in the footer. Apart from the booking page (see below), fonts and all other content are served from our own server.

If you switch off analytics, we store this in your browser’s local storage (localStorage) so the setting still applies on your next visit.

To keep the website secure, our hosting provider may log technical data (IP address, time of visit, browser type, page requested). The legal basis is our legitimate interest in operating the website securely (GDPR Art. 6(1)(f)). The hosting provider keeps these logs for a limited period under its own rules.

The embedded booking system (Appartman) and the payment provider (Stripe) may use their own strictly necessary cookies. Appartman’s booking module uses Google reCAPTCHA to prevent abuse and Google Fonts for display. When these load, Google (Google Ireland Limited) may receive technical data such as your IP address and browser details. The providers’ own privacy policies give more details. The rest of the website loads no such third-party services.

2.9. Analytics and advertising – Google Analytics 4

We use Google Analytics 4 (Google Ireland Limited) to measure how many people visit, where they come from and which pages they view. With Google signals switched on, Google may link the measurement data to your Google account if you are signed in, and use it to create aggregated demographic and interest data as well as advertising audiences (remarketing). Measurement starts when the website loads. If you click Turn off analytics in the footer, the Google code is no longer loaded and the Google Analytics cookies are deleted.

Data	a pseudonymous device ID (in a cookie), pages viewed, time and source of the visit (e.g. Google search, Instagram), device and browser type, approximate location (country, city – Google does not store the IP address), and certain clicks (e.g. the “Book now” button, email, phone, directions, starting the video tour)
Purpose	statistical analysis of website traffic and use, improving the website, and targeting and measuring our ads in Google’s advertising systems (e.g. Google Ads)
Legal basis	legitimate interest – GDPR Art. 6(1)(f): statistical analysis and improvement of the website and advertising the accommodation. You can switch measurement off at any time (objection).
Cookies	_ga, _ga_92MTGHTLPT – for up to 13 months
Retention	data is kept in Google Analytics for 14 months
Settings	Google signals and ad personalisation are switched on. You can manage Google’s own ad settings at myadcenter.google.com.

You can switch off measurement at any time via the Turn off analytics link in the footer. We then delete the Google Analytics cookies and no further data is collected from your browser. Google’s own browser add-on (tools.google.com/dlpage/gaoptout) blocks Google Analytics on all websites.

2.10. Security camera

A recording security camera covers the entrance of the house and the parking area. The camera does not record the inside of the house. A sign warns of the monitored area.

Data	the image and movement of people in the camera’s field of view, vehicles and number plates, the place and time of recording
Purpose	protecting the house, its equipment and vehicles parked on site; preventing, detecting and proving infringements
Legal basis	legitimate interest – GDPR Art. 6(1)(f). The balancing test is available on request by email.
Retention	3 working days from recording if not used. If a recording is used in proceedings, until those proceedings are finally closed.
Access	only the Controller’s management, and the competent authority or court on official request

If a recording affects your rights or legitimate interests, you can ask us within 3 working days of recording not to delete it, so it can be used in official proceedings.

2.11. Social media

Following, liking or commenting on our Instagram and Facebook pages (Meta Platforms Ireland Ltd.) is voluntary. We access page statistics (Insights) as a joint controller with Meta, but individuals cannot be identified from them. Meta’s own privacy policy has the details. If you send us a message, section 2.6 applies.

3. Who can access the data

We treat your data confidentially. Only those who need it for their tasks can access it. We work with the following partners:

Partner	Role	Data
Appartman PMS Technologies Kft. (Dózsa utca 2., 3557 Bükkszentkereszt, tax no. 27441792-2-05)	booking and property management system – processor	booking, VIZA and tourist tax data
Stripe Payments Europe, Ltd. (Dublin, Ireland)	card payments – independent controller	payment data
SZÉP card issuer (OTP, MBH)	SZÉP card payments – independent controller	payment data
Everest Accounting Zrt. (Arany János utca 9. 2/1., 1051 Budapest, tax no. 26516608-2-41)	accounting – processor	billing data
Billingo Technologies Zrt. (Billingo)	invoicing – processor	billing data
Google Ireland Limited (Google Workspace; Dublin, Ireland)	email and document storage – processor	contact data, messages, booking correspondence
DigitalOcean, LLC (USA; European data centre)	website hosting – processor	technical log data
Google Ireland Limited (Google Analytics 4, Google Ads; Dublin, Ireland)	analytics – processor; independent controller for advertising use and Google signals	the data listed in section 2.9

VIZA data can only be accessed by the bodies designated in Act CLVI of 2016, and NTAK receives the statistical data. Beyond this, we only disclose data where required by law or at the request of an authority or court.

4. Transfers outside the EU

Some partners (such as Stripe, Google, DigitalOcean or Meta) may use affiliates outside the EU, including in the United States. Such transfers take place in line with the GDPR, based on the European Commission’s adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.

5. Security

We store data in password-protected systems accessed over encrypted connections (HTTPS). We take all reasonable technical and organisational measures to prevent unauthorised access, loss or damage. Any personal data breach is handled as required by law, including notifying the authority and the people affected where necessary.

6. Your rights

• Access: ask what data we hold about you and request a copy.
• Rectification: ask us to correct inaccurate data.
• Erasure: ask us to delete your data, unless the law requires us to keep it (e.g. invoicing or VIZA data).
• Restriction: ask us to temporarily only store your data.
• Portability: receive the data processed under the contract in a machine-readable format.
• Objection: object at any time to processing based on legitimate interest. You can stop Google Analytics measurement with one click via the Turn off analytics link in the footer.

Send requests to [email protected]. We reply within one month at the latest. This may be extended by two further months where justified, in which case we’ll let you know.

7. Remedies

If you think we have infringed your data protection rights, please contact us first so we can sort it out together. You can also lodge a complaint with the supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH) Falk Miksa utca 9–11., 1055 Budapest · Postal address: 1363 Budapest, Pf. 9. Phone: +36 1 391 1400 · Email: [email protected] · www.naih.hu

You may also go to court. You can bring proceedings before the regional court for your place of residence or stay. You may also lodge a complaint with the data protection authority of your own EU member state.

8. Changes

We may update this policy from time to time, for example if we start working with a new provider. The current version is always available on this page.