( MP Hostel Budapest )

Privacy notice for guests and website visitors

I. General provisions

BESTHOTELMANAGEMENT Kft., as the operator of MP Hostel Budapest (address: 1072 Budapest, Nyár utca 6.; website: mphostel.hu), guarantees in every case the lawfulness and expediency of the processing of the personal data it handles. The purpose of this notice is to give our guests who book accommodation at the Hostel and provide their personal data appropriate information, already before booking or providing their personal data, about the conditions and guarantees under which our company processes their data and for how long. Our company adheres to the contents of this notice in every case involving the processing of personal data, and we consider what is set out here binding on us.

Our company details and contact details are as follows:

Name: BESTHOTELMANAGEMENT Kft.
Registered office: 1037 Budapest, Folyondár utca 9. b. ép.
Company registration number: 01-09-962944
Tax number: 23381050-1-41
Represented by: Boldizsár Zoltán Géza, Managing Director
Telephone number: +36-20/402-0540
Website: mphostel.hu
E-mail: reservation@mphostel.hu

(hereinafter: “Data Controller”)

Our data processing complies with the applicable legislation, in particular the following:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: “GDPR”);
Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information;
Act V of 2013 on the Civil Code;
Act C of 2000 on Accounting;
Act CL of 2017 on the Rules of Taxation;
Act CXXXIII of 2005 on the Rules of Personal and Property Protection and Private Investigation Activities (hereinafter: “Szvtv.”);
Act XLVIII of 2008 on the Basic Conditions and Certain Restrictions of Commercial Advertising Activities;
Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services.

We provide the following information about each of our data processing activities.

II. Individual data processing activities

1. Data processing related to online accommodation booking

Our company offers online accommodation booking so that you can book a room in our hotels quickly, conveniently and free of charge.

Purpose of the processing: to make accommodation booking easier, free of charge and more efficient.

Legal basis of the processing: the prior consent of the person booking the accommodation [Article 6(1)(a) GDPR], and the necessity of taking steps at the request of the data subject prior to entering into a contract between the Data Controller and the data subject [Article 6(1)(b) GDPR].

Scope of the personal data processed: form of address; surname and first name; address (country, postcode, city, street, house number); telephone number; e-mail address; in the case of a business entity, the company name and registered office, bank card number, SZÉP card details (identifier, name on the card), and the name, e-mail address and telephone number of the representative and the contact person.

Duration of the processing: two years following the last day of the stay according to the booking.

Use of a data processor: our company uses the services of an IT service provider for the online booking system as follows.

Name of the data processor: NLG-System Bt.; Registered office: 2135 Csörög, Homokbánya u. 26.; Description of the processing task: Operation of the website

By accepting this notice, the data subject gives their express consent to NetHotelBooking Kft. engaging further data processors, in order to make the service more convenient and personalised, as follows:

Name of the further data processor: The Pass Kft; Registered office: 1061 Budapest, Király utca 30-32; Description of the processing task: Customer management where the SabeeApp front office and channel manager system is used
Name of the further data processor: Triptease Limited; Registered office: WeWork 3 WaterhouseSquare 138-142 Holborn London EC1N 2SW United Kingdom; Description of the processing task: Online chat function through which guests can stay in contact with the hotel and manage their bookings quickly and efficiently
Name of the further data processor: BIG FISH Internet-technológiai Kft.; Registered office: 1066 Budapest, Nyugati tér 1-2; Description of the processing task: Handling the data communication necessary for payment transactions between the merchant and the payment service provider’s system, and ensuring that the transactions can be retrieved by the merchant partners
Name of the further data processor: OTP Mobil Kft.; Registered office: 1093 Budapest, Közraktár u. 30-32.; Description of the processing task: Handling the data communication necessary for payment transactions between the merchant and the payment service provider’s system, providing customer service assistance to users, confirming transactions and fraud monitoring for the protection of users.
Name of the further data processor: Barion Payment Zrt.; Registered office: 1117 Budapest, Infopark sétány 1. I. épület; Description of the processing task: Handling the data communication necessary for payment transactions between the merchant and the payment service provider’s system, providing customer service assistance to users, confirming transactions and fraud monitoring for the protection of users.
Name of the further data processor: Creative Management Kft.; Registered office: 8200 Veszprém, Boksa tér 1. A ép.; Description of the processing task: Performing server hosting tasks

Possible consequences of failure to provide the data: no contract is concluded for the hotel room.
Rights of the data subject: the data subject (the person whose personal data our company processes)
a) may request information on the processing of the personal data relating to them and access to those personal data,
b) may request their rectification,
c) may request their erasure,
d) may request the restriction of the processing of the personal data where the conditions set out in Article 18 GDPR are met (that is, that our company does not erase or destroy the data until a request from a court or authority is received, but for no longer than thirty days, and does not otherwise process the data for any other purpose),
e) may object to the processing of the personal data,
f) may exercise their right to data portability. Under this latter right, the data subject is entitled to receive the personal data relating to them in Word or Excel format, and is further entitled to have our company transmit these data to another controller at their request.

Other information related to the processing: Our company takes all necessary technical and organisational measures to prevent a personal data breach (e.g. damage to or loss of files containing personal data, or such files becoming accessible to unauthorised persons). Should a breach nevertheless occur, we keep a record, for the purpose of checking the necessary measures and informing the data subject, which contains the scope of the personal data concerned, the scope and number of the persons affected by the personal data breach, the date, circumstances and effects of the personal data breach and the measures taken to remedy it, as well as other data specified in the legislation requiring the processing.

Our company has concluded a data processing agreement for the data processing tasks, in which the data processors undertake, if they engage a further data processor, to apply the data protection and data processing guarantees that the data processing agreement imposes on them; accordingly, we ensure the lawful processing of personal data in the case of the data processors as well.

2. Data processing related to requests for quotation

Purpose of the processing: obtaining preliminary information about the hotel’s prices

Legal basis of the processing: the prior consent of the person booking the accommodation [Article 6(1)(a) GDPR], and the processing is necessary in order to take steps at the request of the data subject prior to entering into a contract [Article 6(1)(b) GDPR].

Data subjects: natural persons booking accommodation, and the representatives and contact persons of legal persons booking accommodation

Duration of the processing: two years following the last day of the stay according to the booking.

Use of a data processor: our company uses the services of an IT service provider for the online booking system as follows.

Name of the data processor: NLG-System Bt.; Registered office: 2135 Csörög, Homokbánya u. 26.; Description of the processing task: Operation of the website

Name of the further data processor: Creative Management Kft.; Registered office: 8200 Veszprém, Boksa tér 1. A ép.; Description of the processing task: performing server hosting tasks

Possible consequences of failure to provide the data: The hotel cannot make an offer.

Rights of the data subject: the data subject (the person whose personal data our company processes)
a) may request information on the processing of the personal data relating to them and access to those personal data,
b) may request their rectification,
c) may request their erasure,
d) may request the restriction of the processing of the personal data where the conditions set out in Article 18 GDPR are met (that is, that our company does not erase or destroy the data until a request from a court or authority is received, but for no longer than thirty days, and does not otherwise process the data for any other purpose),
e) may object to the processing of the personal data,
f) may exercise their right to data portability. Under this latter right, the data subject is entitled to receive the personal data relating to them in Word or Excel format, and is further entitled to have our company transmit these data to another controller at their request.

Other information related to the processing: Our company takes all necessary technical and organisational measures to prevent a personal data breach (e.g. damage to or loss of files containing personal data, or such files becoming accessible to unauthorised persons). Should a breach nevertheless occur, we keep a record, for the purpose of checking the necessary measures and informing the data subject, which contains the scope of the personal data concerned, the scope and number of the persons affected by the personal data breach, the date, circumstances and effects of the personal data breach and the measures taken to remedy it, as well as other data specified in the legislation requiring the processing.

3. Data processing related to the provision of services and invoicing

Our company processes the personal data of the guests of MP Hostel Budapest in order to perform the contract concluded with them, including the payment of the fees for the use of the accommodation’s services.

Purpose of the processing: the use by the data subject of the services provided by the accommodation, and the determination and invoicing of the consideration.

Legal basis of the processing: the processing is necessary for the performance of a contract to which the data subject is party [Article 6(1)(b) GDPR], and for compliance with a legal obligation under Section 69(1) and (2) of Act C of 2000 on Accounting [Article 6(1)(c) GDPR]

Scope of the personal data processed: surname and first name, place and date of birth, address, e-mail address, telephone number, identity card number, vehicle registration number, nationality, signature

Duration of the processing: from the time the data subject provides the personal data until 5 years after the performance of the contract (limitation period). If an invoice is issued, the processing lasts from the time the data subject provides the personal data until 8 years after the preparation of the annual report, business report or accounting records for the financial year concerned.

Use of a data processor: our company uses the services of an accountant for invoicing as follows.

Name of the data processor: The Pass; Description of the processing task: Performing accounting tasks

Possible consequences of failure to provide the data: The data subject cannot use the services of the accommodation.

Rights of the data subject: the data subject (the person whose personal data our company processes)

a) may request information on the processing of the personal data relating to them and access to those personal data,

b) may request their rectification,

c) may request their erasure,

d) may request the restriction of the processing of the personal data where the conditions set out in Article 18 GDPR are met (that is, that our company does not erase or destroy the data until a request from a court or authority is received, but for no longer than thirty days, and does not otherwise process the data for any other purpose),

e) may object to the processing of the personal data,

f) may exercise their right to data portability. Under this latter right, the data subject is entitled to receive the personal data relating to them in Word or Excel format, and is further entitled to have our company transmit these data to another controller at their request.

4. Data processing related to newsletter subscription

We use our newsletter to inform its subscribers about our offers, news and promotions.

You can subscribe to the MP Hostel Budapest newsletter (on the www.mphostel.hu website). If you subscribe to this newsletter, you consent to our contacting you with newsletters about MP Hostel Budapest.

Subscribing to the newsletter is not a condition of any of our services, apart from the sending of newsletters.

Purpose of the processing: sending newsletters.

Legal basis of the processing: the consent of the data subject [Article 6(1)(a) GDPR].

Scope of the personal data processed: surname and first name, e-mail address

Duration of the processing: until unsubscribing from the newsletter.

Use of a data processor:

We use the services of an IT service provider for the online newsletter system as follows.

Name of the data processor: NLG-System Bt.; Registered office: 2135 Csörög, Homokbánya u. 26.; Description of the processing task: Storage and operation of the newsletter database
Name of the data processor: NLG-System Bt.; Registered office: 2135 Csörög, Homokbánya u. 26.; Description of the processing task: Operation of the website

Possible consequences of failure to provide the data: The data subject will not receive newsletters from our company.

You can unsubscribe from the newsletter at any time by sending an e-mail to reservation@mphostel.hu or by clicking the unsubscribe icon in the newsletter. In this case, we delete your personal data related to the sending of the newsletter from our database without delay.

Our company has concluded a data processing agreement for the data processing tasks, in which the data processors undertake, if they engage a further data processor, to apply the data protection and data processing guarantees that the data processing agreement imposes on them; accordingly, our company ensures the lawful processing of personal data in the case of the data processor as well.

5. Processing of personal data related to satisfaction surveys

Our aim is to provide our services to the guests of MP Hostel Budapest at a high standard, so we continuously ask our guests for feedback on the experiences they have gathered during their stay at the accommodation.

Purpose of the processing: requesting feedback from the hotel guests in order to further develop and improve the services of MP Hostel Budapest.

Legal basis of the processing: the legitimate interest of the Data Controller [Article 6(1)(f) GDPR], the consent of the data subject [Article 6(1)(a) GDPR].

The legitimate interest pursued: our company has a legitimate interest in obtaining information from the feedback for the development of our services.

Scope of the personal data processed: surname and first name, gender, e-mail address.

Duration of the processing: two years following the last day of the stay according to the booking.

Use of a data processor: our company uses the services of an IT service provider for the online booking system as follows.

Name of the data processor: NetHotelBooking Kft.; Registered office: 8200 Veszprém, Boksa tér 1/A; Description of the processing task: Operation of the satisfaction survey module
Name of the data processor: NLG-System Bt.; Registered office: 2135 Csörög, Homokbánya u. 26.; Description of the processing task: Operation of the website

Possible consequences of failure to provide the data: The data subject will not receive a satisfaction questionnaire from our company.

6. Cookie management and Google Analytics

Using Google Analytics, the Data Controller places a small data package, a so-called cookie, on the user’s computer for the purpose of personalised service, and reads it back during a later visit. If the browser sends back a previously saved cookie, the service provider managing the cookie is able to link the user’s current visit with the previous ones, but only with regard to its own content.

Purpose of the processing: identifying and tracking users and distinguishing them from one another, identifying the users’ current session, storing the data provided during the session, preventing data loss, web analytics measurements, personalised service.

Legal basis of the processing: the consent of the data subject [Article 6(1)(a) GDPR].

Scope of the data processed: IP address, date, time and the previously visited page.

Duration of the processing: a maximum of 90 days from the visit to the website
Use of a data processor: our company uses the services of the IT service providers below as follows.

Name of the data processor: NetHotelBooking Kft.; Registered office: 8200 Veszprém, Boksa tér 1/A; Description of the processing task: Operation of the satisfaction survey module
Name of the data processor: NLG-System Bt.; Registered office: 2135 Csörög, Homokbánya u. 26.; Description of the processing task: Operation of the website

Further information related to the processing: The user can delete the cookie from their own computer and can also disable the use of cookies in their browser.

You can find more information about setting cookie preferences in your browser in the following policies:

You can find more information about the activities of Google Analytics here: https://policies.google.com/privacy?hl=hu.

Possible consequences of failure to provide the data: the services described in points II.1-5 above cannot be used.

7. Website server logging

When you visit our website, the web server automatically logs the user’s activity.

Purpose of the processing: during visits to the website, the service provider records the visitor data in order to check the operation of the services and to prevent abuse.

Legal basis of the processing: the legitimate interest of the Data Controller [Article 6(1)(f) GDPR]

The legitimate interest pursued: our company has a legitimate interest in the secure operation of the website.

Type of personal data processed: identification number, date, time, address of the page visited.

Duration of the processing: a maximum of 90 days from the visit to the website.

Use of a data processor: our company uses the services of an IT service provider for server logging as follows.

Name of the data processor: NetHotelBooking Kft.; Registered office: 8200 Veszprém, Boksa tér 1/A; Description of the processing task: Recording the visitor data and the information necessary for the operation of the server
Name of the data processor: NLG-System Bt.; Registered office: 2135 Csörög, Homokbánya u. 26.; Description of the processing task: Operation of the website

Further information: our company does not link the data arising from the analysis of the log files with other information and does not seek to identify the user. The addresses of the pages visited and the date and time data are not in themselves suitable for identifying the data subject, but when combined with other data (e.g. data provided during registration) they can be used to draw conclusions about the user.

Processing related to logging by external service providers:
The HTML code of the portal contains links coming from and pointing to external servers independent of our company. The server of the external service provider is in direct contact with the user’s computer. We draw our visitors’ attention to the fact that, owing to the direct connection to their servers and their direct communication with the user’s browser, the providers of these links are able to collect user data (e.g. IP address, browser and operating system data, mouse pointer movements, address of the page visited and time of the visit). An IP address is a series of numbers by which the computers and mobile devices of users accessing the internet can be uniquely identified.
IP addresses can even be used to locate geographically the visitor using a given computer. The addresses of the pages visited and the date and time data are not in themselves suitable for identifying the data subject, but when combined with other data (e.g. data provided during registration) they can be used to draw conclusions about the user.

8. Camera surveillance

Our company operates an electronic surveillance system on the premises of MP Hostel Budapest.

Purpose of the processing: protecting the life and physical integrity of the persons staying on the premises of MP Hostel Budapest, and maintaining the security of persons and property by means of an electronic surveillance system (camera system).

The purpose of the camera surveillance carried out by the Data Controller is not employer monitoring under Section 11(1) of the Labour Code (Mt.).
Legal basis of the processing: the express and voluntary consent of the data subject [Article 6(1)(a) GDPR], and the enforcement of the legitimate interest of the Data Controller on the basis of Section 26(1)(e) and Section 31(1)-(4) of the Szvtv. [Article 6(1)(f) GDPR].

Scope of the personal data processed: the facial image, voice and conduct of the data subjects as shown in the image and sound recordings.

Duration of the processing: 3 working days from the data subject’s entry to the premises of Marco Polo Top Ho(s)tel, 30 days in the case of a public event.

Use of a data processor: our company uses the following data processor to operate the electronic surveillance system (camera system).

Name of the data processor: BESTHOTELMANAGEMENT Kft.; Registered office: 1037 Budapest, Folyondár utca 9. b. ép.; Description of the processing task: Operation of the electronic surveillance system (camera system)

Rights of the data subject: the data subject (the person whose personal data our company processes)

a) may request information on the processing of the personal data relating to them and access to those personal data,
b) may request their rectification,
c) may request their erasure,
d) may request the restriction of the processing of the personal data where the conditions set out in Article 18 GDPR are met (that is, that our company does not erase or destroy the data until a request from a court or authority is received, but for no longer than thirty days, and does not otherwise process the data for any other purpose),
e) may object to the processing of the personal data,
f) may exercise their right to data portability. Under this latter right, the data subject is entitled to receive the personal data relating to them in Word or Excel format, and is further entitled to have our company transmit these data to another controller at their request.

Our company has concluded a data processing agreement for the data processing tasks, in which the data processor undertakes, if it engages a further data processor, to apply the data protection and data processing guarantees that the data processing agreement imposes on it; accordingly, we ensure the lawful processing of personal data in the case of the data processor as well.

9. Other data processing

We provide information about data processing not listed in this notice when the data are collected. We inform our clients that certain authorities, bodies performing public tasks and courts may contact our company with a request for the disclosure of personal data. Our company discloses personal data to these bodies, provided that the body concerned has indicated the exact purpose and the scope of the data, only to the extent that is indispensable for achieving the purpose of the request, and only if the fulfilment of the request is required by law.

III. Method of storing personal data, security of processing

Our company’s IT systems and other data storage locations are at the registered office and on servers rented by the data processor. Our company selects and operates the IT tools used for processing personal data in the course of providing the service in such a way that the processed data:

a) are accessible to those authorised to access them (availability);
b) are authentic and their authentication is ensured (authenticity of processing);
c) can be shown to be unchanged (data integrity);
d) are protected against unauthorised access (data confidentiality).

We pay particular attention to the security of the data, and we also take the technical and organisational measures and establish the procedural rules that are necessary to give effect to the guarantees under the GDPR. We protect the data with appropriate measures, in particular against unauthorised access, alteration, transmission, disclosure, erasure or destruction, as well as against accidental destruction or damage, and against becoming inaccessible as a result of changes in the technology used.

The IT systems and networks of our company and of our partners are protected against computer-assisted fraud, computer viruses, computer intrusions and denial-of-service attacks. The operator also ensures security through server-level and application-level protection procedures. The data are backed up daily. Our company takes all possible measures to prevent personal data breaches, and should such a breach occur, we act without delay, in accordance with our internal policy, to minimise the risks and remedy the damage.

IV. Rights of data subjects, legal remedies

The data subject may request information on the processing of their personal data, may request the rectification of their personal data and, with the exception of mandatory processing, their erasure or withdrawal, and may exercise their right to data portability and their right to object in the manner indicated when the data were collected, or via the contact details of the controller given above.

At the data subject’s request, we provide the information in electronic form without delay, and at the latest within 30 days, in accordance with our relevant policy. We fulfil the data subjects’ requests to exercise the rights below free of charge.

Right to information:

Our company takes appropriate measures to provide the data subjects with all the information referred to in Articles 13 and 14 GDPR and every communication under Articles 15–22 and 34 relating to the processing of personal data in a concise, transparent, intelligible and easily accessible form, using clear and plain language, yet in a precise manner.

The right to information may be exercised in writing via the contact details given in point 1. At the data subject’s request, information may also be given orally, after their identity has been verified. We inform our clients that if our company’s staff have doubts about the identity of the data subject, we may request the provision of the information necessary to confirm the data subject’s identity.

The data subject’s right of access:

The data subject is entitled to obtain confirmation from the controller as to whether or not their personal data are being processed. Where personal data are being processed, the data subject is entitled to access the personal data and the following information listed below.

The purposes of the processing;

the categories of personal data concerned;
the recipients or categories of recipients to whom the personal data have been or will be disclosed, including in particular recipients in third countries (outside the European Union) and international organisations;
the envisaged period for which the personal data will be stored;
the right to request rectification, erasure or restriction of processing, and the right to object;
the right to lodge a complaint with the supervisory authority;
information on the sources of the data; the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

In addition, where personal data are transferred to a third country or to an international organisation, the data subject is entitled to be informed of the appropriate safeguards relating to the transfer.

Right to rectification:

Under this right, anyone may request the rectification of inaccurate personal data relating to them that our company processes, and the completion of incomplete data.

Right to erasure:

The data subject is entitled to have us erase the personal data relating to them without undue delay at their request where one of the following grounds applies:

a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b) the data subject withdraws the consent on which the processing is based, and there is no other legal ground for the processing;
c) the data subject objects to the processing, and there are no overriding legitimate grounds for the processing;
d) the personal data have been unlawfully processed;
e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
f) the personal data have been collected in relation to the offer of information society services.

Erasure of the data cannot be requested if the processing is necessary for the following purposes:
a) for exercising the right of freedom of expression and information;
b) for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
c) for reasons of public interest in the area of public health, or for archiving purposes, scientific or historical research purposes or statistical purposes in the public interest;
d) or for the establishment, exercise or defence of legal claims.

Right to restriction of processing:

At the data subject’s request, we restrict the processing where the conditions set out in Article 18 GDPR apply, that is, if:
a) the data subject contests the accuracy of the personal data; in this case the restriction applies for a period enabling the accuracy of the personal data to be verified;
b) the processing is unlawful, and the data subject opposes the erasure of the data and requests the restriction of their use instead
c) the controller no longer needs the personal data for the purposes of the processing, but the data subject requires them for the establishment, exercise or defence of legal claims; or
d) the data subject has objected to the processing; in this case the restriction applies for the period until it is established whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted, such personal data may, with the exception of storage, only be processed with the data subject’s consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State. The data subject must be informed in advance before the restriction of processing is lifted.

Right to data portability:

The data subject is entitled to receive the personal data relating to them which they have provided to the controller in a structured, commonly used and machine-readable format, and to transmit those data to another controller. Our company can fulfil such a request of the data subject in Word or Excel format.

Right to object:

Where personal data are processed for direct marketing purposes, the data subject is entitled to object at any time to the processing of the personal data relating to them for such purposes, including profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the personal data may no longer be processed for such purposes.

Automated individual decision-making, including profiling:

The data subject is entitled not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. This right does not apply if the processing
a) is necessary for entering into, or the performance of, a contract between the data subject and the controller;
b) is authorised by Union or Member State law to which the controller is subject and which, for the protection of the data subject’s rights and freedoms and legitimate interests,
c) also lays down suitable measures; or
d) is based on the explicit consent of the data subject.

Right to withdraw consent:

The data subject is entitled to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Procedural rules:

The Data Controller informs the data subject of the action taken on a request under Articles 15–22 GDPR without undue delay, and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and the number of the requests. The controller informs the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.

Where the data subject has made the request by electronic means, the information is provided by electronic means, unless otherwise requested by the data subject.

If the Data Controller does not take action on the data subject’s request, it informs the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint with the supervisory authority and seeking a judicial remedy.

The Data Controller communicates any rectification or erasure of personal data or restriction of processing it has carried out to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. At the data subject’s request, the controller informs the data subject about those recipients.

Compensation and restitution for non-pecuniary damage:

Any person who has suffered material or non-material damage as a result of an infringement of the data protection regulation is entitled to receive compensation from the controller or the processor for the damage suffered. The processor is liable for the damage caused by processing only where it has not complied with the obligations laid down by law specifically for processors, or where it has disregarded or acted contrary to the lawful instructions of the controller. Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and are responsible for any damage caused by the processing, each controller or processor is jointly and severally liable for the entire damage.

The controller or the processor is exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.

Right to go to court and data protection authority proceedings:

If the data subject considers that the Data Controller has infringed their right to the protection of personal data in the course of its processing, they may seek a remedy from the competent bodies under the applicable legislation as follows:

they may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information

address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c.;
website: www.naih.hu;
e-mail address: ugyfelszolgalat@naih.hu;
telephone: +36-1-391-1400
(hereinafter: “NAIH”)

they may turn to the competent court.
The court hears the case as a matter of priority.
The Data Controller undertakes to cooperate fully with the court concerned or the NAIH in these proceedings and to disclose the data relating to the processing to the NAIH or the court concerned.

V. Miscellaneous provisions

The Data Controller undertakes that all processing related to its activities complies with the requirements set out in this notice, in the Data Controller’s internal policy (which imposes the same requirements as this notice) and in the legislation in force.

The Data Controller reserves the right to amend this notice at any time, provided that it informs the data subjects of any changes, after they have been made, by means of an announcement published on the MP Hostel Budapest website.

If you have any questions about the contents of this notice, please e-mail us.

Last updated: 05.10.2026

Privacy notice for guests and website visitors

I. General provisions

II. Individual data processing activities

1. Data processing related to online accommodation booking

2. Data processing related to requests for quotation

3. Data processing related to the provision of services and invoicing

4. Data processing related to newsletter subscription

5. Processing of personal data related to satisfaction surveys

6. Cookie management and Google Analytics

7. Website server logging

8. Camera surveillance

9. Other data processing

III. Method of storing personal data, security of processing

IV. Rights of data subjects, legal remedies

V. Miscellaneous provisions

Request an offer

Thank you, we have received your request.