Categories of the data, purpose of data processing, and legal basis of the data processing:

In the case of a booking mediated by an external partner, the categories of data transmitted to us may be narrower.

• The data necessary for booking is necessary for taking steps at the request of the data subject prior to the conclusion of the contract. [GDPR Article 6(1)(b)] Providing the data is a precondition for the booking. For booking, we may request the following data so that we can identify the guest making the booking; so that we can give the room to the right person upon check-in; keep in touch with the guest and record the payment method and the payment instrument with which the guest secured their booking: name, arrival and departure date, arrival time, number of people staying in a room; age of children; room type; details of the SZÉP card, credit card or debit card used to secure the booking or for online payment; e-mail address, telephone number, address, comments (where you can specify any preferences).

• If you enter any sensitive personal data in the comments or the communication with the hotel (such as food sensitivity, allergies, health information), the legal basis of the data processing is your express consent [in addition to GDPR Article 6(1)(a), also GDPR Article 9(2)(a)], and its purpose is the fulfilment of your request. You may withdraw your consent at any time using the contact details below, but this shall not affect the lawfulness of the data processing that preceded it.

• We use your email address and phone number in the following cases:

i. we send the reservation confirmation to the e-mail address provided during the booking – processing necessary for the fulfilment of contract [GDPR Article 6(1)(b)] The reservation is not possible without providing the data;

ii. if we need to notify you of a change affecting your booking (e-mail address, phone number), data processing necessary for the fulfilment of the contract [GDPR Article 6(1)(b)] The reservation is not possible without providing the data;

iii. three days and then one day before your planned arrival, to remind you of important information related to your reservation such as the hotel address and check-in time; and to inform you of current news and the Loyalty Membership Program – data processing necessary for the fulfilment of the contract (e-mail, WhatsApp, SMS). [GDPR Article 6(1)(b)] Reservation online or by phone is not possible without providing the data;

iv. during your stay, so that we can stay in touch with you and inform you about current news and the Loyalty Membership Program (WhatsApp) - data processing based on our legitimate interest in providing a high-standard service. [GDPR Article 6(1)(f)] You may object to the data processing any time using the contact details below, or by sending a reply message with the word “STOP”.

v. three days after your departure, to ask that you share your comments about your stay with us so that we can provide you and other guests with an even better service in the future (e-mail, WhatsApp) - data processing based on our legitimate interest in providing a high-standard service. [GDPR Article 6(1)(f)] You may object to the data processing in the case of e-mail by sending a text message and in the case of WhatsApp and SMS by sending the word “STOP”. You need to unsubscribe from the various channels separately (points iv., v.).

Purpose of the data processing:

• We process the invoice data (name, address, discount certificate, or card number) on the basis of our legal obligation in accordance with Section 169(2) of Act C of 2000 on Accounting. [GDPR Article 6(1)(c)] Data processing is a condition for providing the service.

• After your departure, we will retain the above-listed data based on our legitimate interest associated with the assertion of legal claims and complaint management, within the statute of limitations under the civil law, i.e. 5 years following the year concerned. [GDPR Article 6(1)(f)] You may object to the data processing using the contact details below.

Period of the data processing:

• Where information is needed for issuing an invoice (name, home address, discount certificate or card number), we have a legal obligation to retain this data for 8 years from the end of the calendar year. Thus if we issue you the invoice when you check out on 1 September 2024, we must keep the data until 31 December 2032.

• After your departure, we will keep the data listed above for the period of limitation stipulated under civil law, i.e. for 5 years following the year concerned.

Processors:

• For sending WhatsApp and SMS messages before, during, and after the stay, we use the service of Servi Smart Solution Ltd (6 Hachilazon, Entrance A RAMAT GAN, Central District, 5252270, Israel). The conformity of the data transfer is guaranteed by the Commission Decision. (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061)

• For booking purposes, your personal data is processed by Virtual Zoom s.r.o. (registered office: Office center Zirkon, Sokolovská 131/86 - Karlín, 186 00 Praha 8), our data processor, who is responsible for the appropriate functioning of our CRM system (customer relationship management).

• Your personal data will be processed by THN (The Hotels Network, S.L. Avda. Diagonal, 439, 3º-1ª, 08036 Barcelona, Spain) as a data processor, responsible for the proper functioning of the forms.

• When you make a booking on our website you are entering data into the SynXis central reservation platform operated by Sabre Hospitality Solutions GmbH (Main Airport Center (MAC), Unterschweinstiege 2-14, 60549 Frankfurt am Main, Germany.

Rights:

[GDPR Article 6(1)(a)] In the case of consent: 1.1.-1.6., 1.8-1.13.

[GDPR Article 6(1)(b)] In the case of data required for the fulfilment of the contract: 1.1.-1.4., 1.6., 1.8-1.13.

[GDPR Article 6(1)(c)] In the case of data required for legal compliance: 1.1.-1.3., 1.6., 1.8, 1.10.-1.13.

[GDPR Article 6(1)(f)] In the case of legitimate interest: 1.1.-1.4., 1.6.-1.8., 1.10.-1.13.

If you wish to exercise any of your rights referred to in section 1 in relation to the data recorded as described above, in respect of Ensana hotels in Hungary, or you wish to contact us for any other reason in connection with the above, please let us know by sending an e-mail to adat(at)hu.ensanahotels.com or data(at)hu.ensanahotels.com.

Please find the detailed information on the rights here.

Categories of the data, purpose of data processing, and legal basis of the data processing:

Mandatory personal data to be provided:

• Based on the provisions of the Tourism Act – Act CLVI of 2016 on the state duties relating to the development of tourism regions, Section 9/H –, in order to fulfil the legal obligation, we record and store the following data of all of our hotel guests: family name and first name; their family name and first name at birth; their place and date of birth; their sex; their citizenship; their mother’s surname and first name at birth; the identification data of their personal ID document or travel document; and , for third-country citizens, their visa or entry permit numbers, as well as the place and time of their entry into the country. [GDPR Article 6(1)(c)] Data processing is a condition for check-in.

• A local council regulation may prescribe that additional data be retained we process this also in the interest of compliance. [GDPR Article 6(1)(c)] Data processing is a condition for check-in.

• In order to provide the requested services (accommodation, spa services, etc.) (for the purposes and based on the performance of the contract), we also process the following data: contact details, loyalty card number, method of payment, bankcard details, room number, number of guests, age of children [GDPR Article 6(1)(b)] Data processing is a condition for check-in.

• In order to provide the discount services (such as the welcome drink) ordered for the room (for the purposes and based on the fulfilment of the contract), we process the room number or the discount certificate or card number. [GDPR Article 6(1)(b)] Data processing is a condition for using the discounted service.

• If you enter any sensitive personal data in the communication with the hotel (such as food sensitivity, allergies, health information), the legal basis of the data processing is your express consent [in addition to GDPR Article 6(1)(a), also GDPR Article 9(2)(a)], and its purpose is the fulfilment of your request. You may withdraw the consent at any time, but this shall not affect the lawfulness of the data processing that preceded it.

• We use your email address and phone number in the following cases:

i. if we need to notify you of any issue that comes up (e.g. items forgotten in the hotel) (e-mail address, phone number) – data processing necessary for the fulfilment of the contract. [GDPR Article 6(1)(b)] It is not possible to check in without providing the data;

ii. during your stay, so that we can stay in touch with you and inform you about current news and the Loyalty Membership Program (WhatsApp) - data processing based on our legitimate interest in providing a high-standard service. [GDPR Article 6(1)(f)] You may object to the data processing any time using the contact details below, or by sending a reply message with the word “STOP”.

iii. three days after your departure, to ask that you share your comments about your stay with us so that we can provide you and other guests with an even better service in the future (e-mail, WhatsApp) - data processing based on our legitimate interest in providing a high-standard service. [GDPR Article 6(1)] You may object to the data processing in the case of e-mail by sending a text message and in the case of WhatsApp and SMS by sending the word “STOP”.

You need to unsubscribe from the various channels separately.

Purpose of the data processing:

• We process the invoice data (name, address, discount certificate, or card number) on the basis of our legal obligation in accordance with Section 169(2) of Act C of 2000 on Accounting. [GDPR Article 6(1)(c)] Data processing is a condition for check-in.

• After your departure, we will retain the above-detailed data based on our legitimate interest associated with the assertion of legal claims and complaint management, within the statute of limitations under the civil law, i.e. 5 years following the year concerned. [GDPR Article 6(1)(f)] You may object to the data processing using the contact details below.

Non-compulsory statistical data:

• For statistical purposes, we treat the following data separately from personal data: business trip, holiday.

Most of the data is completed based on the booking and the rest at the time of check-in using an ID document reader. We ask you to please always check the accuracy of your data.

Period of the data processing:

• Where information is needed for issuing an invoice, we have a legal obligation to retain this for 8 years from the end of the calendar year. Thus if we issue you the invoice when you check out on 1 September 2024, we must keep the data until 31 December 2032.

• The hotel has a legal obligation to keep the data that serves the basis for the tourist tax for 5 years following the year concerned, counting from the day of check-in. The data may vary from city to city.

• It is our legal obligation to store the personal data recorded under the Tourism Act in our Company’s central repository until the end of the following year.

• After your departure, we will keep the data provided upon check-in for the period of limitation stipulated under civil law, i.e. for 5 years following the year concerned.

Processors:

• For sending WhatsApp and SMS messages before, during, and after the stay, we use the service of Servi Smart Solution Ltd (6 Hachilazon, Entrance A RAMAT GAN, Central District, 5252270, Israel), The conformity of the data transfer is guaranteed by the Commission Decision. (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061).

• In relation to check-in your personal data is processed by Virtual Zoom s.r.o. (registered office: Office center Zirkon, Sokolovská 131/86 - Karlín, 186 00 Praha 8), our data processor, who is responsible for the appropriate functioning of our CRM system (customer relationship management).

• Your personal data will be processed by THN (The Hotels Network, S.L. Avda. Diagonal, 439, 3º-1ª, 08036 Barcelona, Spain) as a data processor that assists in the proper functioning of the guest database.

Rights:

[[GDPR Article 6(1)(a)] In the case of consent: 1.1.-1.6., 1.8-1.13.

[GDPR Article 6(1)(b)] In the case of data required for the fulfilment of the contract: 1.1.-1.4., 1.6., 1.8-1.13.

[GDPR Article 6(1)(c)] In the case of data required for legal compliance: 1.1.-1.3., 1.6., 1.8, 1.10.-1.13.

[GDPR Article 6(1)(f)] In the case of legitimate interest: 1.1.-1.4., 1.6.-1.8., 1.10.-1.13.

If you wish to exercise any of your rights referred to in section 1 in relation to the data recorded during check-in, or you wish to contact us for any other reason in connection with data recorded during check-in, please let us know by sending an email to adat(at)hu.ensanahotels.com or data(at)hu.ensanahotels.com.

Please find the detailed information on the rights here.

You can use the health services separately from the other services of the hotel. You can access the treatments offered by the hotel on the basis of the curative health package already requested or by selecting it on site. Before providing health-related services, an employee working in the separate section of the hotel that deals with this directs each guest to a doctor. At the doctor, you will receive a Treatment Record Card, which the doctor will fill in as follows:

•Data required for identification: name, social security number, date of birth, telephone number

•Past history: illnesses, medications, complaints, etc. The recording of health data is part of the medical treatment. The treating doctor decides which medical data needs to be recorded in accordance with the professional regulations.

The guest then shows up for the given treatment with his/her Treatment Record Card, where the staff participating in the treatment only see the minimum information required for providing the care specified on the Treatment Record Card. The detailed data on the patient will only be seen by the doctor and his/her assistant.

Purpose of the data processing:

Promoting the protection, improvement and maintenance of your health.

Legal basis of the data processing:

•with regard to the mandatory personal identification data for the use of healthcare services: Statutory requirement [GDPR Article 6(1)(c); GDPR Article 9(1)(h)];

• with regard to personal data that is not mandatory for the use of healthcare services, but deemed necessary by the doctor: Your consent [GDPR Article 6(1)(a); GDPR Article 9(1)(a)]. Consent can be withdrawn at any time in person at the doctor’s office or by email at adat(at)hu.ensanahotels.com or data(at)hu.ensanahotels.com. Such withdrawal, however, shall not affect the lawfulness of any processing that preceded it. Since you have contacted us voluntarily, your consent regarding the processing of your personal data shall – in accordance with Section 12(2) of Act XLVII of 1997 – be deemed to have been given, unless you state otherwise.

Period of the data processing:

Pursuant to Section 30(1) of Act XLVII of 1997, medical records shall be retained for 30 (thirty) years from data recording. The data may be kept for treatment purposes even after the expiry of the mandatory registration period, where necessary.

Data transfer:

•The following data must be recorded and forwarded to the Electronic Healthcare Services Platform (in Hungarian: Elektronikus Egyészségügyi Szolgáltatási Tér or EESZT):

For Hungarian guests: name, name at birth, social security number, date and place of birth, mother’s maiden name;

For foreign guests: name, name at birth, passport number or the number of asylum-seeker, applicant or reception card, number of European Health Insurance Card;

Additional data in the case of persons who have not yet requested refugee, asylum and subsidiary protection status: address, place and date of birth, mother’s name

For all guests: Healthcare documentation (diagnosis, complaint, status, recommended treatment)

•The health data may only not be forwarded to your GP if you expressly object to this.

Processing or Data Processing:

Depending on the hotel, either HostWare Kft. (registered office: 1149 Budapest, Róna utca 120-122; task: software maintenance) or Hospitality and Retail Systems Kft. (registered office: 1138 Budapest, Madarász Viktor utca 47-49; task: software maintenance) is the data processor during data processing.

Rights:

[GDPR Article 6(1)(a)] In the case of consent: 1.1.-1.6., 1.8-1.13

[GDPR Article 6(1)(c)] In the case of data required for legal compliance: 1.1.-1.3., 1.6., 1.8, 1.10.-1.13.

If you wish to exercise any of your rights referred to in section 1 in relation to the data recorded during the provision of health services, or you wish to contact us for any other reason in connection with data recorded during the provision of health services, please let us know by sending an email to adat(at)hu.ensanahotels.com or data(at)hu.ensanahotels.com.

Please find the detailed information on the rights here.

Purpose of the data processing:

Provision of gym services and complaints management:

•the name, date of birth and photo are used for identification purposes;

•the data related to health and to your membership helps us provide you with a personalised service and avoid risks to your health;

•the other personal data (phone number, email address) is used for maintaining contact with you; providing these contact details is not compulsory, but it is necessary if you want us to be able to contact you.

Non-compulsory statistical data:

•for statistical purposes, we treat the following data separately from personal data: e.g. where you heard about the club.

Legal compliance:

•in the case of a private individual, the name and address.

To speed up the purchase process, some data will be left to be completed at check-in. We ask you to please always check the accuracy of your data.

Legal basis of the data processing:

• Performance of the contract concluded for the provision of gym services. [GDPR Article 6(1)(b)]. Afterwards, our legitimate interest associated with complaint management, for 1 year after the expiry of the subscription or from the one-time access. [GDPR Article 6(1)(f)] The provision of the data marked by star, the processing of the photo and membership card data are prerequisites to providing the service. You can object to the processing of your data for complaint handling purposes at any time by sending an email to adat(at)hu.ensanahotels.com, or data(at)hu.ensanahotels.com.

• In the framework of this service, we process your medical data on the basis of your express consent. [GDPR Article 6(1)(a) and Article 9(2)(a)] You may withdraw your consent any time at adat(at)hu.ensanahotels.com, or data(at)hu.ensanahotels.com, however, the withdrawal of consent shall not affect the lawful processing before its withdrawal. Please note that if we are not allowed to record your medical data, we will not be able to exercise the utmost care when providing gym services.

• If your name and address are stated on the invoice for the subscription and ticket purchase, the legal basis of the data processing is legal compliance [GDPR Article 6(1)(c)]. A private individual cannot make purchases without providing the data.

Period of the data processing:

• We process your personal data for 1 year from the end of the year in which your gym membership expired or from the end of the year of your one-time entry to the gym, for the purpose of complaints management. If you withdraw your consent before the expiry of the 1 year period, we will erase your health data when the withdrawal is communicated.

• Where information is needed for issuing an invoice, we have a legal obligation to retain this for 8 years from the end of the calendar year. Thus if we issue you the invoice with a date of 1 September 2024, we must keep the data until 31 December 2032.

For guests signing up to the newsletter or consenting to receive promotional materials, the Company shall process the data listed above further, in accordance with the provisions under section 1.7 of this Policy.

Rights:

[GDPR Article 6(1)(a)] In the case of consent: 1.1.-1.6., 1.8-1.13

[GDPR Article 6(1)(b)] In the case of data required for the fulfilment of the contract: 1.1.-1.4., 1.6., 1.8-1.13.

[GDPR Article 6(1)(c)] In the case of data required for legal compliance: 1.1.-1.3., 1.6., 1.8, 1.10.-1.13.

[GDPR Article 6(1)(f)] In the case of legitimate interest: 1.1.-1.4., 1.6.-1.8., 1.10.-1.13.

If you wish to exercise any of your rights referred to in section 1 in relation to the data recorded for the purpose of the provision of this service, or you wish to contact us for any other reason, please let us know by sending an email to adat(at)hu.ensanahotels.com, or data(at)hu.ensanahotels.com.

Please find the detailed information on the rights here.

As part of the Company’s quality assurance process, guests can give their opinion on the services of Ensana hotels by means of an email or paper-based guest questionnaire, or with the help of the review system. When completing the questionnaire, you can specify the following personal data:

• Name

• Date of visit

• Room number

• Contact details (address, email address, phone number, home address)

Giving the data is not compulsory; the purpose of the data is simply to allow us to accurately investigate possible complaints and to ensure we can respond to them.

The Company may also use the opinions received in this way, and any data specified in relation thereto that cannot be traced back to the given Guest or linked to the Guest’s name, for statistical purposes.

When providing reviews, the Guests can choose to also send the guest review to public platforms (e.g. Google, Tripadvisor).

If you provide your opinion in an anonymous way, we will not process any personal data. If you request feedback from us, our employee will contact you at one of the contact details provided (email, address, phone number) within 30 days at the latest. If you enter the room number, we will try to immediately resolve the complaints made during your stay.

Purpose of the data processing:

To maintain contact with the reviewer, and to manage complaints.

Legal basis of the data processing:

Your consent [GDPR Article 6(1)(a)]. The consent may be withdrawn at any time using the contact details below. Please note that if we do not receive your consent to the processing of your data or if you withdraw such consent, we will not be able to respond to your question. Withdrawal of consent does not affect the lawfulness of the data processing that preceded it.

Period of the data processing:

Messages and personal data received in this way will be deleted one year after the given request, question or complaint has been responded to. We process the review linked to the room number during your stay, afterwards we process it as statistical data.

Rights: 1.1.-1.6., 1.8-1.13.

If you wish to exercise any of your rights referred to in section 1 in relation to the data thus provided, or you wish to contact us for any other reason in connection with the above data processing, please let us know by sending an email to adat(at)hu.ensanahotels.com, or data(at)hu.ensanahotels.com.

Please find the detailed information on the rights here.

Cameras are used on the premises of the hotels, in order to assure the safety of Guests and their personal belongings. Guests are reminded of the presence of these cameras through signs featuring a picture of a camera and an accompanying text.

You can ask for more information about the data processing related to the video surveillance system from the front-desk staff at the hotel concerned. We will send you the Privacy Policy of such video surveillance systems at your request. If you have such requests, please let us know by sending a message to the hotel’s general e-mail address or postal address, or by e-mail to adat(at)hu.ensanahotels.com, or data(at)hu.ensanahotels.com.

In order to be able to send newsletters for marketing purposes, we process your name, email address and, occasionally, your home address. In connection with the sending the newsletters, you have the option to set the topics and the region that you would like to receive newsletters on. In addition to the above, we store your language settings, the time of subscription, and the pertaining IP address.

For our Thematic newsletters we request your age (our treatment packages may vary by age category); your sex (e.g. for information on services for women); and/or postal code (for programs announced in a certain city). Providing the data necessary for sending thematic newsletters is optional. If you do not provide the personal data necessary for this (e.g. your age), we will send you only the general newsletters addressed to everyone, but no special (e.g. age-specific) newsletters.

We use your personal data for our Facebook ads, in a way that enables Facebook to display our ad to people with a similar profile using the name and email address.

Purpose of the data processing:

Marketing, and as a part of this, informing you about our latest special offers and other news.

Legal basis of the data processing:

Your consent [GDPR Article 6(1)(a)]

Period of the data processing:

We only send you our newsletter for as long as you request it. If you no longer wish to receive our newsletter, you can unsubscribe at any time either by using the dedicated link at the end of each newsletter or by notifying us at adat(at)hu.ensanahotels.com, or data(at)hu.ensanahotels.com-. Withdrawal of consent does not affect the lawfulness of the data processing that preceded it.

Data transfer: Data is transferred to Companies that operate hotels functioning under the Ensana brand. Please note that Ensana s.r.o., Slovenské liečebné kúpele Piešťany, a.s., Balneoclimaterica SRL and Léčebné lázně Mariánské Lázně a.s. may each be specified as senders of the newsletter. DData is transferred to Facebook (Meta Platforms Ireland Limited (Serpentine Avenue, Block J, Dublin 4, Ireland)) and Criteo S.A. (32 rue Blanche, 75009 Paris, France) for the purpose of lookalike marketing. As part of this process, Facebook and Criteo use the customer's name and email address to display our advertisements to users with similar profiles. More information: https://www.facebook.com/business/help/164749007013531?id=401668390442328 and https://help.criteo.com/kb/guide/en/about-audiences-0EJNOqUqYu/Steps/842036,1683194,2079922.

Processor or data processor:

Your personal data is processed by Virtual Zoom s.r.o. (registered office: Office center Zirkon, Sokolovská 131/86 - Karlín, 186 00 Praha 8), our data processor, who is responsible for the appropriate functioning of our CRM system (customer relationship management) and who is obliged to conduct the data processing activity in accordance with the terms of the contract between us and with the relevant statutory provisions.

Your personal data will be processed by THN (The Hotels Network, S.L., Avda. Diagonal, 439, 3º-1ª, 08036 Barcelona, Spain) as a data processor, responsible for the proper functioning of the forms, and obliged to carry out its processing activities in accordance with the contractual terms existing between us, and with the applicable legal requirements.

Rights: 1.1.-1.6., 1.8-1.13

If you wish to exercise any of your rights referred to in section 1 in relation to the data thus provided, or you wish to contact us for any other reason in connection with the above data processing, please let us know by sending an email to adat(at)hu.ensanahotels.com, or data(at)hu.ensanahotels.com.

Please find the detailed information on the rights here.

Ensana offers its own loyalty membership program.

Ensana Life loyalty programme rewards the loyalty of its guests with discounts and other benefits based on nights spent at Ensana hotels.

Further information: https://ensanahotels.com/en/ensana-life/terms-and-conditions

Please find the detailed information on the rights here.

In the case of payment on site at the hotels and online payment, we request the following credit/debit card details:

• Name on the card

• Card number

• Expiry date

• CVC (only in the case of payment)

• Address

• Email address

• IP address

Purpose of the data processing:

To secure the payment or the booking, and to be able to charge the total price of the booking or a part of it, depending on the conditions of the booking.

Legal basis of the data processing:

Fulfilment of the contract concluded for the purpose of room booking as a service. [GDPR Article 6(1)(b)] After fulfilment, compliance with the law, based on Section 169(2) of Act C of 2000 on Accounting [GDPR Article 6(1)(c)], Giving the data is compulsory; it is a precondition for the provision of the service.

Period of the data processing:

The debit/credit card details are encrypted; release of this data is only done by the data processor. The data controller does not process bankcard data. The data processor has PCI-DSS Level 1 certification.

Processor or data processor:

The service is provided by Adyen N.V. (registered office: Adyen N.V.; Simon Carmiggeltstraat 6-50, 1011 DJ in Amsterdam, the Netherlands.) as data processor.

Rights:

[GDPR Article 6(1)(c)] In the case of data required for legal compliance: 1.1.-1.3., 1.6., 1.8, 1.10.-1.13.

[GDPR Article 6(1)(f)] In the case of legitimate interest: 1.1.-1.4., 1.6.-1.8., 1.10.-1.13.

If you wish to exercise any of your rights referred to in section 1 in relation to the data thus provided, or you wish to contact us for any other reason in connection with the above data processing, please let us know by sending an email to adat(at)hu.ensanahotels.com, or data(at)hu.ensanahotels.com.

Please find the detailed information on the rights here.

The Company and the hotels, restaurants and fitness clubs operated by the Company can also be contacted individually via the social media platforms Facebook and Instagram. By hitting the “like” and “follow” button on the given page, Facebook users can subscribe to the news published on newsfeed; by hitting the “dislike” button they can unsubscribe to it, and by adjusting the newsfeed settings, they can hide the news they do not wish to follow from the newsfeed. The Company is able to access its “followers’” profiles; however, it does not record or process them in its own internal system. On YouTube, you can follow and unfollow using the ‘subscribe/unsubscribe’ button.

Purpose of the data processing:

Sharing the contents on the websites of the Company and of the hotels, restaurants and fitness clubs, etc. operated by the Company; sharing other news and offers, maintaining contact. Via the Facebook pages, you can book a room, participate in prize draws and also find out about our latest promotions.

Legal basis of the data processing:

Your consent [GDPR Article 6(1)(a)], which can be withdrawn at any time by unsubscribing. The withdrawal of consent does not affect the lawful processing that preceded it. In the case of withdrawal, you will not receive notifications on your newsfeed; our news will no longer appear on your newsfeed, though you will still be able to access the Company’s newsfeed, since our website is public.

Period of the data processing:

The data processing lasts until you unsubscribe.

The operator of the Facebook and Instagram pages provides the Controller the opportunity to display advertisements and use the page analytics function. The page analytics function displays aggregated data designed to help the Data Controller understand how visitors interact with the given page and its advertisements and to draw conclusions for a more efficient operation. No personal data are included in statistical analyses. The processing of data for advertising and statistical purposes on these pages is carried out jointly by the Data Controller and Meta Platforms Ireland Limited (Serpentine Avenue, Block J, Dublin 4, Ireland). The details of the joint data processing agreement can be found in the data processing appendix of the Facebook Page Analytics function. The appendix is available on the following link: https://www.facebook.com/legal/terms/page_controller_addendum

In other cases, Facebook, YouTube, and Instagram are independent data controllers separate from us. You can find information about the data processing of the site at the following links:

Facebook: https://www.facebook.com/about/privacy/update

Instagram: help.instagram.com

YouTube: https://www.youtube.com/intl/ALL_en/howyoutubeworks/user-settings/privacy/

In the event of a room booking, the system automatically redirects the guest to the Company’s website. The data processing takes place in accordance with the provisions of section 2.1.

Rights: 1.1.-1.6., 1.8-1.13.

If you wish to exercise any of your rights referred to in section 1 in relation to the data thus provided, or you wish to contact us for any other reason in connection with the above data processing, please let us know by sending an email to adat(at)hu.ensanahotels.com, or data(at)hu.ensanahotels.com.

Please find the detailed information on the rights here.

Hotel restaurant coupons and programme tickets, daily tickets for the use of various fitness and spa services, as well as passes and day spa programmes may also be purchased in the form of vouchers via the online system (web store), by filling out the online order form, for which the following data will be required:

• Family name

• Given name

• Email address

• Phone number

• Billing data (name, country, postcode, city, street, house number)

In addition to the above, the Company processes the date and time of purchase, the name and price of the service, the total amount of the purchase and the IP address of the customer.

Purpose of the data processing:

Maintaining contact with the customers, the provision of service, the processing of the purchase and the fulfilment of the relevant accounting obligations. The purpose of retaining the data after the purchase is to enforce any claims and manage any complaints.

Legal basis of the data processing:

• Fulfilment of the contract, considering also Section 13/A of Act CVIII of 2001 on certain issues related to e-commerce and information-society services. Giving the data is compulsory; it is a precondition for the purchase. [GDPR Article 6(1)(b)]

• In respect of the data on the invoice (name, address), compliance with the law, based on Section 169(2) of Act C of 2000 on Accounting [GDPR Article 6(1)(c)] Giving the data is compulsory; it is a precondition for the purchase.

• The legal basis of retaining the data after the purchase is our legitimate interest associated with the purpose of the processing, i.e. asserting claims and managing complaints. [GDPR Article 6(1)(f)] You may object to the data processing any time using the contact details below.

Period of the data processing:

•The personal data will be kept for 5 years after the service has been provided.

•The data on the receipt related to the purchase (name, address) will be kept for 8 years from the date of purchase. For online card payments, you will be automatically redirected to the website of the following data controller:

For online card payments, you will be automatically redirected to the website of the following data controller:

OTP Mobil Kft. (Registered office: 1143 Budapest, Hungária körút 17-19.; company registration number: 01-09-174466; website: https://simplepay.hu/)

Processor or data processor:

For purchases in the webshop, számlázz.hu (KBOSS.hu Kft., seated in 1031 Budapest, Záhony utca 7/D.) acts as a data processor in the course of issuing the invoices.

Rights:

[GDPR Article 6(1)(b)] In the case of data required for the fulfilment of the contract: 1.1.-1.4., 1.6., 1.8-1.13.

[GDPR Article 6(1)(c)] In the case of data required for legal compliance: 1.1.-1.3., 1.6., 1.8, 1.10.-1.13.

[GDPR Article 6(1)(f)] In the case of legitimate interest: 1.1.-1.4., 1.6.-1.8., 1.10.-1.13.

If you wish to exercise any of your rights referred to in section 1 in relation to the data thus provided, or you wish to contact us for any other reason in connection with the above data processing, please let us know by sending an email to adat(at)hu.ensanahotels.com, or data(at)hu.ensanahotels.com.

Please find the detailed information on the rights here.

Reserving our prices that provide certain extra discounts (e.g. Direkt discount) is subject to subscription to the newsletter. The extra discount can be used also from most of the promotional price offers, but cannot be combined with other discount codes or percentage discounts (e.g. Ensana Life discount, SZÉP card discount). The promotion applies to the Ensana hotels in Hungary.

During registration (sign-up), it is compulsory to provide your email address and possibly your name. By registering for the discounted price, you consent to us sending newsletters to the email address that you provide. You may naturally unsubscribe from the newsletter at any time.

Purpose of the data processing:

Provision of information about discounts and special offers.

Legal basis of the data processing:

Your voluntary consent. You may withdraw your consent at any time, but this will not affect the legitimate data processing that occurred before the withdrawal of consent. Please note that if you do not consent to the processing of the data, we will not be able to keep you informed about our special offers. {GDPR Article 6(1)(a)}

Period of the data processing:

Until withdrawal of the consent.

Rights: 1.1.-1.6., 1.8-1.13.

If you wish to exercise any of your rights referred to in section 1 in relation to the data thus provided, or you wish to contact us for any other reason in connection with the above data processing, please let us know by sending an email to adat(at)hu.ensanahotels.com, or data(at)hu.ensanahotels.com.

Your personal data is processed by Virtual Zoom s.r.o. (registered office: Office center Zirkon, Sokolovská 131/86 - Karlín, 186 00 Praha 8), our data processor, who is responsible for the appropriate functioning of our CRM system (customer relationship management) and who is obliged to conduct the data processing activity in accordance with the terms of the contract between us and with the relevant statutory provisions.

If you subscribe via Facebook, the operator of the Facebook and Instagram pages (Meta Platforms Ireland Limited, seat: Serpentine Avenue, Block J, Dublin 4, Ireland; https://www.facebook.com/privacy/explanation; https://www.facebook.com/help/instagram/155833707900388/) provides the Controller the opportunity to display advertisements and use the page analytics function. The page analytics function displays aggregated data designed to help the Data Controller understand how visitors interact with the given page and its advertisements and to draw conclusions for a more efficient operation. No personal data are included in statistical analyses. The processing of data for advertising and statistical purposes on these pages is carried out jointly by the Data Controller and Meta Platforms Ireland Limited (Serpentine Avenue, Block J, Dublin 4, Ireland). The details of the joint data processing agreement can be found in the data processing appendix of the Facebook Page Analytics function. The appendix is available on the following link: https://www.facebook.com/legal/terms/page_controller_addendum

Intren Informatikai Tanácsadó és Szolgáltató Kft. (seat: 1125 Budapest, György Aladár utca 35-39. E. building 411.) is the data processor for Facebook marketing campaigns.

Please find the detailed information on the rights here.

You can contact us (e.g. to ask for a quote) at any of our contact details (email, Facebook, phone, post or through the forms designed for this purpose).

Purpose of the data processing:

Maintaining contact with the requester, answering and resolving the question/request.

Legal basis of the data processing:

Since it is you who is contacting us, the legal basis for data processing is your consent [GDPR Article 6(1)(a)]. You can withdraw your consent at any time, but in this case we will not be able to respond to your request. Withdrawal does not affect the lawfulness of the data processing that preceded it.

Please note that the data fields on the various forms were created based on our experience, and involve requesting the minimum of data that we need to answer the request concerned. Mandatory fields are marked with a red asterisk.

Period of the data processing:

Messages and personal data received in this way will be deleted one year after the given request, question or complaint has been responded to. However, if, due to the nature of the correspondence, it is necessary for tax or accounting reasons, or perhaps for the purpose of protecting the rights and interests of the Company or the requester, it will be archived and stored for the necessary time, which we assess individually in each case.

Data transfer:

The inquiry regarding a particular hotel shall be forwarded to the relevant member of the Ensana Health Spa Hotel.

Processor or data processor:

Your personal data will be processed by THN (The Hotels Network, S.L., NIF B-65542714, Calle Muntaner, 262, 3º-1ª, 08021 Barcelona, Spain) as a data processor, responsible for the proper functioning of the forms, and obliged to carry out its processing activities in accordance with the contractual terms existing between us, and with the applicable legal requirements.

Rights: 1.1.-1.6., 1.8-1.13.

If you wish to exercise any of your rights referred to in section 1 in relation to the data thus provided, or you wish to contact us for any other reason in connection with the above data processing, please let us know by sending an email to adat(at)hu.ensanahotels.com, or data(at)hu.ensanahotels.com.

Please find the detailed information on the rights here.

During the management of a consumer complaint, if you do not agree with the way the complaint has been handled, or if it is not possible to investigate the complaint promptly, the Company is obliged to draft, without delay, a report on the complaint and, if it has been able to formulate one, its position regarding it.

The report must contain the following data:

• The consumer’s name and address

• The place, time and mode of submitting the complaint

• A detailed description of the consumer’s complaint, a list of receipts, documents and other items of evidence provided by the consumer

• A statement by the Company on its position regarding the consumer’s complaint, if a prompt investigation of the complaint is possible

• The signature of the person who took down the report and – except for verbal complaints made over the phone or by email – the signature of the consumer

• The place and time the report was taken down

• In the case of a verbal complaint made over the phone or by email, the unique reference number of the complaint

Purpose of the data processing:

Investigation of the complaint and maintaining contact with the complainant and legal compliance.

Legal basis of the data processing:

Provisions of Section 17/A (7) of Act CLV of 1997 on consumer protection, which makes the above data processing mandatory. [GDPR Article 6(1)(c)]

Period of the data processing:

Three years from the time that the report was taken down.

Rights: 1.1.-1.3., 1.6., 1.8, 1.10.-1.13.

If you wish to exercise any of your rights referred to in section 1 in relation to the data thus provided, or you wish to contact us for any other reason in connection with the above data processing, please let us know by sending an email to adat(at)hu.ensanahotels.com, or data(at)hu.ensanahotels.com.

Please find the detailed information on the rights here.

Like most companies, our Company maintains a business relationship with certain employees of other organisations, whose names, job position and contact details we store.

Purpose of the data processing:

In all cases, such data storage is carried out with the consent of the person concerned, so that our companies can communicate for the purpose of co-operation.

Legal basis of the data processing:

The legal basis of our data processing activity is our legitimate interest associated with the performance of the contract or with maintaining contact between the companies [GDPR Article 6(1)(f)]. You may object to the data processing using the contact details below.

Period of the data processing:

• We check the contact information of our business contacts at least once a year and remove those that are no longer up-to-date from the system. The details of contacts are therefore kept until the contact person changes or the relationship ends.

• We keep the details of contact persons specified on the contracts for 8 years after the contract is terminated, due to the accounting regulations.

We apply the same procedure when processing the personal data of press contacts.

Rights: 1.1.-1.4., 1.6.-1.8., 1.10.-1.13.

If you wish to exercise any of your rights referred to in section 1 in relation to the data thus provided, or you wish to contact us for any other reason in connection with the above data processing, please let us know by sending an email to adat(at)hu.ensanahotels.com, or data(at)hu.ensanahotels.com.

Please find the detailed information on the rights here.

If you are dissatisfied with our services, you can make a comment in the guest book. We are obliged to investigate the complaint and provide feedback on it. Authorities authorised to inspect commercial activities may inspect the entries made in the customer book retroactively for three years, as well as the duplicate of the response to the written customer complaint.

Purpose of the data processing:

Providing a customers’ book is a legal obligation.

Legal basis of the data processing:

Fulfilment of a legal obligation. Due to the provisions of consumer protection law – based on Section 25 of Government Decree 210/2009 (IX. 29) on the conditions for the performance of commercial activities – keeping a customer book and retention are necessary. Providing the data is a precondition for being able to respond.[GDPR Article 6(1)(c)]

Period of the data processing:

Entries are kept for 3 years, separately from each other.

Rights: 1.1.-1.3., 1.6., 1.8, 1.10.-1.13.

If you wish to exercise any of your rights referred to in section 1 in relation to the data thus provided, or you wish to contact us for any other reason in connection with the above data processing, please let us know by sending an email to adat(at)hu.ensanahotels.com, or data(at)hu.ensanahotels.com.

Please find the detailed information on the rights here.

If you use wireless internet in our hotels, we must record the following data:

• date and start and end time of use,

• source IP address, source MAC address, target IP address (+ target port)

Purpose of the data processing:

Fulfilment of a legal obligation.

Legal basis of the data processing:

Fulfilment of a legal obligation. Recording and retention are necessary on the basis of Section 159/A(1) of Act C of 2003 on electronic communication. Providing the data is a precondition for the use. [GDPR Article 6(1)(c)]

Period of the data processing:

The data will be kept for 1 year.

Rights: 1.1.-1.3., 1.6., 1.8, 1.10.-1.13.

If you wish to exercise any of your rights referred to in section 1 in relation to the data thus provided, or you wish to contact us for any other reason in connection with the above data processing, please let us know by sending an email to adat(at)hu.ensanahotels.com, or data(at)hu.ensanahotels.com.

Please find the detailed information on the rights here.