Privacy Policy - Coach Hire Hungary

In brief

We collect and process personal data only in accordance with the law.
We send direct marketing (DM) messages only with your separate consent. We may send system messages without it.
We store data as securely as possible.
We disclose personal data to third parties only with your consent.
We give anyone information about the data we hold on them, and you may request the deletion of your data at any time through our contact details.

Introduction

ECB Travel Korlátolt Felelősségű Társaság (registered seat: 1144 Budapest, Tihany utca 17. 1st floor 6.; company registration number: 01-09-292657; tax number: 25852770242) (hereinafter: the Service Provider, data controller) submits itself to the following notice.

Section 20 (1) of Act CXII of 2011 on informational self-determination and freedom of information (hereinafter: Infotv.) provides that the data subject (in this case the website user, hereinafter: the User) must be informed, before the processing begins, whether the processing is based on consent or is mandatory.

Before the processing begins, the data subject must be clearly and fully informed of all facts relating to the processing of their data, in particular of the purpose and legal basis of the processing, the person entitled to carry out the processing and the data processing, and the duration of the processing.

Under Section 6 (1) of the Infotv., the data subject must also be informed that personal data may be processed even where obtaining the data subject’s consent is impossible or would involve disproportionate cost, and the processing of the personal data is:

necessary for the performance of a legal obligation applying to the controller, or
necessary for the enforcement of a legitimate interest of the controller or a third party, and the enforcement of that interest is proportionate to the restriction of the right to the protection of personal data.

The information must also cover the data subject’s rights and legal remedies in connection with the processing.

Where providing personal information to the data subjects is impossible or would involve disproportionate cost (such as, in this case, on a website), the information may also be provided by publishing the following:

a) the fact of data collection,
b) the scope of the data subjects,
c) the purpose of the data collection,
d) the duration of the processing,
e) the possible controllers entitled to access the data,
f) a description of the data subjects’ rights and legal remedies in connection with the processing, and
g) where the processing is subject to registration in the data protection register, the registration number of the processing.

This privacy notice governs the data processing of the following websites: https://ecbtravel.hu/ and is based on the content requirements above. The notice is available at: https://ecbtravel.hu/adatvedelmi-tajekoztato/. Amendments to the notice take effect on publication at the above address.

Definitions (Section 3)

data subject / User: any specified natural person identified or identifiable, directly or indirectly, on the basis of personal data;
personal data: data that can be associated with the data subject (in particular the data subject’s name, identifier, and knowledge characteristic of one or more aspects of their physical, physiological, mental, economic, cultural or social identity), and any conclusion about the data subject that can be drawn from the data;
data controller: the natural or legal person, or organisation without legal personality, who, alone or jointly with others, determines the purpose of the processing, makes and carries out the decisions on the processing (including the means used), or has them carried out by a data processor it engages;
data processing: regardless of the procedure used, any operation or set of operations performed on data, in particular collection, recording, organisation, storage, alteration, use, retrieval, transfer, disclosure, alignment or combination, blocking, erasure and destruction, as well as preventing further use of the data, taking photographs, audio or video recordings, and recording physical characteristics suitable for identifying a person (for example a fingerprint or palm print, DNA sample, iris image);
data processing (technical): the performance of technical tasks related to the processing operations, regardless of the method and means used and the place of application, provided that the technical task is performed on the data;
data processor: the natural or legal person, or organisation without legal personality, who processes data under a contract with the controller, including where the contract is concluded on the basis of a legal provision;
data protection incident: unlawful processing of personal data, in particular unauthorised access, alteration, transfer, disclosure, erasure or destruction, as well as accidental destruction and damage.

Sale of products

Under Section 20 (1) of Act CXII of 2011, the following must be defined for the processing related to the sale of products: a) the fact of data collection, b) the scope of the data subjects, c) the purpose of the data collection, d) the duration of the processing, e) the possible controllers entitled to access the data, f) a description of the data subjects’ rights.

The fact of data collection, the scope of data processed and the purpose of processing:

Personal data	Purpose of processing
Surname and first name	Required for contact, for the purchase and for issuing a proper invoice.
Email address	Keeping contact.
Phone number	Keeping contact, more efficient handling of questions about invoicing or delivery.
Billing name and address (tax number)	Issuing a proper invoice, and creating the contract, defining its content, amending it, monitoring its performance, invoicing the resulting fees and enforcing related claims.
Time of purchase	Performing a technical operation.
IP address at the time of purchase	Performing a technical operation.

The email address does not need to contain personal data.

Scope of data subjects: all data subjects who make a purchase on the website.
Duration of processing, deadline for erasure: processing lasts until the data subject’s request for erasure. Except for accounting documents, since under Section 169 (2) of Act C of 2000 on accounting these must be retained for 8 years. Accounting documents that directly or indirectly support the bookkeeping (including general ledger accounts, analytical and detailed records) must be kept in legible form for at least 8 years, retrievable by reference to the accounting records.
Possible controllers entitled to access the data: the personal data may be processed by the controller’s sales and marketing staff, respecting the principles above.
Description of the data subjects’ rights: the data subject may request the erasure or modification of personal data by post at 1144 Budapest, Tihany utca 17., by email at info@ecbtravel.hu, or by phone at +36 1 306 3976 (Mon to Fri, 8:00 to 17:00).
Data processor (hosting provider): Tárhely.EU (Post: 1538 Budapest, Pf.: 510; Phone: +36 1 789 2 789; Email: support@tarhely.eu; Web: https://www.tarhely.eu/).
Legal basis: the User’s consent, Section 5 (1) of the Infotv., and Section 13/A (3) of Act CVIII of 2001 on certain issues of electronic commerce services and information society services (hereinafter: Elker Act).

Booking a trip / travel contract

Under Section 20 (1) of Act CXII of 2011, the following must be defined for booking a trip (and concluding a travel contract) as processing: a) to f) as above.

The fact of data collection, the scope of data processed and the purpose of processing:

Personal data	Purpose of processing
Surname and first name	Required for contact, for the booking, for preparing the contract and for issuing a proper invoice.
Email address	Keeping contact, preparing the contract.
Phone number	Keeping contact, preparing the contract, more efficient handling of invoicing questions.
Billing name and address	Issuing a proper invoice, and creating the contract, defining its content, amending it, monitoring its performance, invoicing the resulting fees and enforcing related claims.
Time of the booking	Performing a technical operation.
IP address at the time of the booking	Performing a technical operation.

The email address does not need to contain personal data.

Scope of data subjects: all data subjects who book a trip and conclude a travel contract on the website.
Duration of processing, deadline for erasure: until the data subject’s request for erasure, except for accounting documents (8 years, as above).
Possible controllers entitled to access the data: the controller’s sales and marketing staff.
Rights: erasure or modification may be requested by post (1144 Budapest, Tihany utca 17.), by email (info@ecbtravel.hu) or by phone (+36 1 306 3976, Mon to Fri, 8:00 to 17:00).
Data processor (hosting): Tárhely.EU (as above).
Legal basis: the User’s consent, Section 5 (1) of the Infotv., and Section 13/A (3) of the Elker Act.

Cookies

The fact and scope of data processed: unique identifier, dates, times.
Scope of data subjects: all data subjects visiting the website.
Purpose: identifying users and tracking visitors.
Duration / cookie lifetimes:

Google Analytics cookies: 2 years
Google Maps API: 3 months
Facebook cookies: 3 months
WooCommerce data (cart): session
WooCommerce session id: 2 days
Consent to the use of cookies: 1 year
Security-related cookies: 1 to 2 days

Controllers entitled to access: the controller does not process personal data through cookies.
Rights: data subjects can delete cookies in the Tools/Settings menu of their browser, usually under the Privacy settings.
Legal basis: the data subject’s consent is not required where the sole purpose of the cookies is the transmission of a communication over an electronic communications network, or is strictly necessary for the provision of an information society service expressly requested by the subscriber or user.

Use of Google Ads (AdWords) conversion tracking

The controller uses the online advertising programme “Google AdWords” and, within it, Google’s conversion tracking service. Google conversion tracking is an analytics service of Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”).
When a User reaches a website through a Google ad, a cookie needed for conversion tracking is placed on their computer. These cookies have limited validity and contain no personal data, so the User cannot be identified by them.
When the User browses certain pages of the website and the cookie has not yet expired, both Google and the controller can see that the User clicked on the ad.
Every Google AdWords customer receives a different cookie, so they cannot be tracked across AdWords customers’ websites.
The information obtained with the conversion tracking cookies serves to produce conversion statistics for customers who opt for AdWords conversion tracking. Customers thereby learn the number of users who clicked on their ad and were forwarded to a page with a conversion tracking tag. They do not, however, receive information that could identify any user.
If you do not wish to take part in conversion tracking, you can refuse it by disabling the installation of cookies in your browser. You will then not appear in the conversion tracking statistics.
Further information and Google’s privacy policy are available at google.de/policies/privacy/.

Use of Google Analytics

This website uses Google Analytics, a web analytics service of Google Inc. (“Google”). Google Analytics uses so-called “cookies”, text files stored on your computer, to help analyse how the User uses the website.
The information generated by the cookies about the User’s use of the website is usually transmitted to and stored on a Google server in the USA. By activating IP anonymisation on the website, Google shortens the User’s IP address beforehand within the member states of the European Union or in other states party to the Agreement on the European Economic Area.
The full IP address is transmitted to a Google server in the USA and shortened there only in exceptional cases. On behalf of this website’s operator, Google will use this information to evaluate how the User used the website, to compile reports on website activity for the operator, and to provide further services related to website and internet use.
Within Google Analytics, the IP address transmitted by the User’s browser is not combined with other Google data. The User can prevent the storage of cookies by setting their browser accordingly; however, please note that in this case some functions of this website may not be fully usable. The User can also prevent Google from collecting and processing the cookie data on their website use (including the IP address) by downloading and installing the browser plugin available at https://tools.google.com/dlpage/gaoptout?hl=hu.

Newsletter, DM activity

Under Section 6 of Act XLVIII of 2008 on the basic conditions and certain restrictions of commercial advertising activity, the User may consent in advance and expressly to the Service Provider contacting them with advertising offers and other mailings at the contact details given at registration.
Furthermore, the Customer may, bearing in mind the provisions of this notice, consent to the Service Provider processing the personal data needed to send the advertising offers.
The Service Provider does not send unsolicited advertising messages, and the User may unsubscribe from the offers at any time, without restriction or justification, free of charge. In that case the Service Provider deletes from its records all personal data needed to send advertising messages and does not contact the User with further advertising offers. The User can unsubscribe from the ads by clicking the link in the message.
The fact and scope of data processed: name, email address, date, time.
Scope of data subjects: all data subjects who subscribe to the newsletter.
Purpose: sending electronic messages containing advertising to the data subject, providing information on current information, products, promotions, new features, etc.
Duration: until the consent is withdrawn, that is, until unsubscription.
Controllers entitled to access: the controller’s staff.
Rights: the data subject may unsubscribe from the newsletter at any time, free of charge.
Legal basis: the data subject’s voluntary consent, Section 5 (1) of the Infotv., and Section 6 (5) of Act XLVIII of 2008.

Social media pages

The fact and scope of data processed: the name registered on Facebook / Google+ / Twitter / Pinterest / YouTube / Instagram, etc., and the user’s public profile picture.
Scope of data subjects: all data subjects who have registered on these social media sites and “liked” the website.
Purpose: sharing, “liking” and promoting certain content, products, promotions, or the website itself on social media.
Duration, deadline for erasure, controllers entitled to access and rights: the data subject can find information about the source, processing, method and legal basis of the transfer on the given social media site. The processing takes place on the social media sites, so the duration and method of processing, and the options for deletion and modification, are governed by the rules of the given social media site.
Legal basis: the data subject’s voluntary consent to the processing of their personal data on the social media sites.

Data transfer

The fact and scope of data processed.
Scope of data transferred for carrying out delivery: delivery name, delivery address, phone number.
Scope of data transferred for carrying out online payment: billing name, billing address, email address.
Scope of data subjects: all data subjects requesting home delivery / online purchase.
Purpose: confirming transactions and fraud monitoring (checking for abuse) to protect users.
Possible controllers entitled to access the data:

MPL Magyar Posta Logisztika Kft., 1138 Budapest, Dunavirág utca 2-6.; ugyfelszolgalat@posta.hu; Phone: 06/80 299 929 (freephone); in Budapest and surroundings: (06-1) 333-7777; rural delivery: (06-1) 333-7777.
OTP Bank Zrt., registered seat: 1051 Budapest, Nádor utca 16.; Tel.: 06-1-473-5000; Fax: 06-1-473-5955; https://www.otpbank.hu/portal/hu/JogiEtikaiNyilatkozat

Rights: the data subject may request the prompt erasure of their personal data from the delivery / online payment service provider acting as controller.
Legal basis: the User’s consent, Section 5 (1) of the Infotv., and Section 13/A (3) of Act CVIII of 2001.

Customer relations and other processing

If a question arises or a data subject has a problem while using the controller’s services, they can contact the controller in the ways given on the website (phone, email, social media, etc.).
The controller deletes incoming emails and messages, and data given by phone, Facebook, etc., together with the enquirer’s name and email address and any other voluntarily provided personal data, at the latest 2 years after the data was provided.
Processing not listed in this notice is disclosed when the data is collected.
In the case of an exceptional request from an authority, or a request from other bodies authorised by law, the Service Provider is obliged to provide information, disclose or hand over data, and make documents available. In such cases the Service Provider discloses to the requester only as much personal data, and only to the extent, as is strictly necessary to achieve the purpose of the request.

Data security (Section 7)

The controller plans and carries out the processing operations so as to protect the privacy of data subjects.
The controller ensures the security of the data (password and antivirus protection) and takes the technical and organisational measures and establishes the procedural rules needed to enforce the Infotv. and other data and secrecy protection rules.
The controller protects the data with appropriate measures, in particular against: unauthorised access, alteration, transfer, disclosure, erasure or destruction, accidental destruction and damage, and inaccessibility due to changes in the technology applied.
The controller ensures by appropriate technical means that the data stored in the records cannot be directly linked and assigned to the data subject.
To prevent unauthorised access, alteration and unauthorised disclosure or use of personal data, the controller ensures: the creation and operation of an appropriate IT and technical environment; the controlled selection and supervision of staff involved in the service; and the issue of detailed operational, risk management and service procedures.
On this basis, the Service Provider ensures that the data it processes is available to those entitled, that its authenticity and authentication are ensured, and that its integrity can be verified.
The IT system of the controller and its hosting provider protects, among other things, against computer fraud, espionage, computer viruses, spam, hacks and other attacks.

Rights of data subjects

The data subject may request that the Service Provider give information about the processing of their personal data, may request the rectification of their personal data, and may request the erasure or blocking of their personal data (except for mandatory processing).
At the data subject’s request, the controller provides information about the data it processes (or that is processed by a processor it engages or instructs), their source, the purpose, legal basis and duration of the processing, the name, address and processing-related activity of the processor, the circumstances, effects and remedial measures of any data protection incident, and, where the data subject’s personal data is transferred, the legal basis and recipient of the transfer.
The controller keeps a record (through its internal data protection officer, if it has one) to monitor measures related to data protection incidents and to inform the data subject; the record contains the scope of personal data affected, the scope and number of data subjects affected, the time, circumstances and effects of the incident, the remedial measures taken, and other data required by law.
The controller keeps a data transfer record to monitor the lawfulness of transfers and to inform the data subject; it contains the time, legal basis and recipient of transfers, the scope of personal data transferred, and other data required by law.
At the User’s request, the Service Provider provides information about the data it processes, their source, the purpose, legal basis and duration of the processing, the name, address and processing-related activity of any processor, and, where the data is transferred, the legal basis and recipient. The Service Provider provides the information in writing, in an understandable form, as soon as possible but within 25 days at most. The information is free of charge.
If the personal data does not correspond to reality and the correct personal data is available to the controller, the controller rectifies the personal data.
Instead of erasure, the Service Provider blocks the personal data if the User requests it, or if it can be assumed on the basis of available information that erasure would harm the User’s legitimate interests. Blocked personal data may be processed only as long as the processing purpose that excluded erasure exists.
The Service Provider erases the personal data if its processing is unlawful, the User requests it, the data processed is incomplete or incorrect (and this cannot be lawfully remedied), provided erasure is not excluded by law, the purpose of processing has ceased, the statutory retention period has expired, or it has been ordered by a court or the National Authority for Data Protection and Freedom of Information.
The controller marks the personal data it processes if the data subject disputes its correctness or accuracy, but the incorrectness or inaccuracy cannot be clearly established.
The data subject, and all those to whom the data was previously transferred for processing, must be notified of the rectification, blocking, marking and erasure. Notification may be omitted if it does not harm the data subject’s legitimate interest in view of the purpose of the processing.
If the controller does not fulfil the data subject’s request for rectification, blocking or erasure, it communicates the factual and legal reasons for the rejection in writing within 25 days of receiving the request. In the event of such a rejection, the controller informs the data subject of the possibility of a judicial remedy and of turning to the Authority.

Legal remedies

The User may object to the processing of their personal data if:

the processing or transfer of the personal data is necessary solely for the performance of a legal obligation applying to the Service Provider, or for the enforcement of a legitimate interest of the Service Provider, the data recipient or a third party, unless the processing was ordered by law;
the personal data is used or transferred for the purpose of direct marketing, opinion polling or scientific research;
in other cases specified by law.

The Service Provider examines the objection as soon as possible but within 15 days at most, decides on its merits and informs the applicant of the decision in writing. If the Service Provider finds the objection justified, it terminates the processing (including further data collection and transfer), blocks the data, and notifies all those to whom it previously transferred the data concerned and who are obliged to act to enforce the right to object.
If the User disagrees with the Service Provider’s decision, they may turn to a court within 30 days of its communication. The court acts out of turn.
A complaint against any infringement by the controller may be lodged with the National Authority for Data Protection and Freedom of Information:

National Authority for Data Protection and Freedom of Information (NAIH)
1125 Budapest, Szilágyi Erzsébet fasor 22/C.
Postal address: 1530 Budapest, Pf.: 5.
Phone: +36-1-391-1400; Fax: +36-1-391-1410; Email: ugyfelszolgalat@naih.hu

Judicial enforcement

The controller must prove that the processing complies with the law. The lawfulness of a transfer must be proven by the data recipient.
Adjudication of the case falls within the competence of the regional court (törvényszék). The case may, at the data subject’s choice, also be brought before the regional court of the data subject’s place of residence or stay.
A party to the case may also be someone who otherwise lacks legal capacity to be a party. The Authority may intervene in the proceedings in the interest of the data subject’s success.
If the court upholds the claim, it orders the controller to provide the information, rectify, block or erase the data, annul the decision made by automated processing, take the data subject’s right to object into account, or release the data requested by the data recipient.
If the court rejects the data recipient’s claim, the controller must erase the data subject’s personal data within 3 days of the communication of the judgment. The controller must also erase the data if the data recipient does not turn to the court within the specified deadline.
The court may order the publication of its judgment (with the controller’s identifying data) if the interests of data protection and the protected rights of a larger number of data subjects so require.

Compensation and damages

If the controller infringes the data subject’s personality rights by unlawfully processing the data subject’s data or by breaching the data security requirements, the data subject may claim damages (sérelemdíj) from the controller.
The controller is liable to the data subject for damage caused by the data processor, and must also pay the data subject the damages due for a violation of personality rights caused by the processor. The controller is exempt from liability for the damage caused and from the obligation to pay damages if it proves that the damage or the violation of the data subject’s personality rights was caused by an unavoidable cause outside the scope of the processing.
No damage needs to be compensated and no damages may be claimed to the extent that the harm resulted from the intentional or grossly negligent conduct of the injured party.

Closing

In preparing this notice we took the following legislation into account:

Act CXII of 2011 on informational self-determination and freedom of information (Infotv.)
Act CVIII of 2001 on certain issues of electronic commerce services and information society services (primarily its Section 13/A)
Act XLVII of 2008 on the prohibition of unfair commercial practices against consumers
Act XLVIII of 2008 on the basic conditions and certain restrictions of commercial advertising activity (in particular its Section 6)
the Act on electronic freedom of information
the Act on electronic communications (specifically its Section 155)
Opinion 16/2011 on the EASA/IAB recommendation on best practice for behavioural online advertising
the recommendation of the National Authority for Data Protection and Freedom of Information on the data protection requirements of prior information.

Other

The website https://ecbtravel.hu/ is protected by copyright. The offers, texts and images displayed on the website are the intellectual property of ECB Travel Kft. The trademark, logo and web design used on the website are owned by ECB Travel Kft.

Copies of the website may be made by printing, downloading to data carriers or transmitting to another person for personal, but not commercial, purposes. It is prohibited to publish the displayed texts and images in another catalogue, publication or website, in printed or electronic form alike.

The information on this website has been compiled with the greatest care, but is for information purposes only. We apologise for any errors or typos that may occur, but we cannot accept liability for them. ECB Travel Kft. reserves the right to make any change to its website at any time, without prior notice. ECB Travel Kft. accepts no liability for any losses or costs (for example lost profit, commission, indirect or consequential loss) that may be caused by any modifications made to the offers displayed on the website.