This is a translation for convenience. In case of any discrepancy, the Hungarian version prevails.
Privacy Notice
This notice explains what personal data we process when you subscribe to the opening notification on hillgate.hu, contact us, book accommodation or stay with us; what we use the data for, how long we keep it, to whom we disclose it, and what rights you have. This notice has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.).
1. The data controller
| Name | PrideAndProperty Építő Kft. |
|---|---|
| Registered office | 1111 Budapest, Irinyi József utca 31. 1. em. 8. |
| Company registration number | 01-09-397140 (Fővárosi Törvényszék Cégbírósága – Court of Registration of the Budapest-Capital Regional Court) |
| Tax number | 27766507-2-43 |
| info@hillgate.hu | |
| Telephone | +36 70 390 7728 |
We are not required to appoint a data protection officer. You may contact us with any data protection enquiry using the contact details above.
2. What data do we process, and for what purpose?
2.1. Opening notification (subscription on the website)
| Data processed | name, email address, intended travel period, number of guests, message (if provided), time and IP address of subscription |
|---|---|
| Purpose | notifying you of the opening of HillGate and the launch of bookings; answering your enquiry |
| Legal basis | your consent – Article 6(1)(a) GDPR |
| Retention period | until consent is withdrawn, but no later than 12 months after opening (31 January 2028) |
2.2. Newsletter and offers (with separate consent)
| Data processed | name, email address, time of consent |
|---|---|
| Purpose | sending offers, packages and news by email |
| Legal basis | your consent – Article 6(1)(a) GDPR, and Section 6 of Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities |
| Retention period | until you unsubscribe (you can unsubscribe in every email) |
2.3. Contact and requests for quotation
| Data processed | name, email address, telephone number, content of the message |
|---|---|
| Purpose | answering questions, providing quotations |
| Legal basis | steps prior to entering into a contract – Article 6(1)(b) GDPR; for other enquiries, our legitimate interest in serving prospective guests – Article 6(1)(f) GDPR |
| Retention period | 1 year after the matter is closed; where a contract is concluded, as set out in Section 2.4 |
2.4. Accommodation booking and performance of the contract
| Data processed | name, email address, telephone number, address/country, booking details (period, apartment, number of guests, ages of children), special requests, payment details (method and fact of payment; bank card details are processed not by us but by the payment service provider), billing name and address |
|---|---|
| Purpose | recording and confirming the booking, providing the service, arranging arrival, communication during the stay |
| Legal basis | performance of a contract – Article 6(1)(b) GDPR |
| Retention period | until claims arising from the contract become time-barred, i.e. 5 years after departure (Section 6:22 of the Ptk. – Civil Code) |
2.5. Guest register (VIZA) and NTAK reporting
| Data processed | surname and forename, surname and forename at birth, place and date of birth, sex, nationality, mother's surname and forename at birth, identification details of the identity document; for third-country nationals, the number of the visa or residence permit and the date and place of entry; the start and end dates of use of the accommodation service, and the address of the accommodation |
|---|---|
| Purpose | mandatory data recording to protect the rights, safety and property of guests and to protect public security; statistical reporting to the Nemzeti Turisztikai Adatszolgáltató Központ (NTAK – National Tourism Data Service Centre) |
| Legal basis | legal obligation – Article 6(1)(c) GDPR; Section 9/H of Act CLVI of 2016 on the state tasks relating to the development of tourist regions and its implementing decrees |
| Retention period | for the period specified by law; the accommodation management software transmits the data in encrypted form to the VIZA (guest register system) storage facility, where it remains for the period specified by law and may be accessed only by authorities entitled to do so. Only statistical data that cannot be used for personal identification (anonymous data) is sent to NTAK. |
2.6. Invoicing, accounting, tourist tax
| Data processed | billing name, address, tax number (for companies), invoice details; data necessary for recording tourist tax (number of guest nights, grounds for exemption) |
|---|---|
| Legal basis | legal obligation – Article 6(1)(c) GDPR; Act CXXVII of 2007 on Value Added Tax, Section 169 of Act C of 2000 on Accounting, Act C of 1990 on Local Taxes |
| Retention period | 8 years, as required by the Accounting Act |
2.7. Guest communication and reviews
Before and during your stay we keep in touch with you by message (email, SMS or WhatsApp) in order to perform the booking (Article 6(1)(b) GDPR). After your departure we may ask you once to review your stay – this is based on our legitimate interest (Article 6(1)(f) GDPR), and you may object to it at any time.
2.8. Video surveillance
[To be completed only if there will be a camera in the car park/at the entrance: camera locations, purpose (property protection), legal basis (legitimate interest), retention (3 working days if not used), warning sign. No cameras may operate in the apartments or in the wellness area.]
2.9. Technical data of the website and cookies
To operate the website, the hosting provider's server logs visitors' IP addresses, browser type and time of visit (legitimate interest: secure operation – Article 6(1)(f) GDPR); we retain this data for no more than 30 days. Statistical and marketing cookies are used only with your consent; for details, see the Cookie Notice.
3. Who has access to the data? (data processors, recipients)
| Recipient | Role, activity |
|---|---|
| Namecheap, Inc. (4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA) | data processor – website hosting and email forwarding |
| [Provider of the property management software / channel manager – e.g. Previo s.r.o.] | data processor – booking management, online booking engine, VIZA and NTAK data transmission |
| [Online payment service provider] | independent data controller – bank card payments |
| [Invoicing software provider, accounting firm] | data processor – invoicing, accounting |
| Online travel agencies (e.g. Booking.com B.V., Expedia Group, Airbnb Ireland UC, Szallas.hu – Szállás Group Zrt.) | independent data controllers – if you book through them, we receive your data from them in order to fulfil the booking |
| VIZA storage provider (the organisation designated by the state tourism administration body), Magyar Turisztikai Ügynökség (Hungarian Tourism Agency) – NTAK | by law |
| Google Ireland Ltd., Meta Platforms Ireland Ltd. | only with your consent – statistics, advertising measurement (see the Cookie Notice) |
| Our partners providing ancillary services (e.g. transfers, massage, golf course) | only at your request, with the data necessary for the requested service (name, time, number of guests) |
We disclose data at the request of the authorities in the cases prescribed by law. We do not sell your data, nor do we disclose it to third parties for their marketing purposes.
4. Transfer of data outside the European Union
The hosting provider (Namecheap, Inc.) and, with your consent, Google and Meta are companies connected to the United States. Data is transferred on the basis of the adequacy decision under the EU–US Data Privacy Framework or, in its absence, on the basis of standard data protection clauses adopted by the European Commission (Article 46 GDPR).
5. Data security
We receive data over an encrypted (HTTPS) connection, store it in password-protected systems, and only those of our staff who need it for their duties have access to it. The subscriber list is stored outside the website's public directory, in a location that cannot be accessed directly from the web.
6. Your rights
- Information and access – you may ask what data of yours we process and request a copy of it.
- Rectification – you may request the correction of inaccurate data.
- Erasure – you may request the erasure of your data if it is no longer needed or if you withdraw your consent (unless we are legally required to retain it).
- Restriction – you may request that, in the event of a dispute, we only store your data and do not use it.
- Data portability – you may receive the data processed on the basis of consent or contract in a machine-readable format.
- Objection – you may object at any time to processing based on legitimate interest, and unconditionally to direct marketing.
- Withdrawal of consent – at any time, without giving reasons, without affecting the lawfulness of processing prior to withdrawal.
You may send your request to info@hillgate.hu; we will reply within one month at the latest. Fulfilling your request is free of charge.
7. Legal remedies
If you believe we have infringed your data protection rights, please contact us first. You may also lodge a complaint with the Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information):
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
1055 Budapest, Falk Miksa utca 9–11. · Postal address: 1363 Budapest, Pf. 9.
Telephone: +36 1 391 1400 · Email: ugyfelszolgalat@naih.hu · www.naih.hu
If your rights are infringed, you may also go to court; at your choice, you may bring the action before the regional court (törvényszék) competent for your place of residence or stay.
8. Amendments to this notice
We update this notice in line with changes in legislation and in our services. The version currently in force is always available on this page.