Privacy policy
How we handle your personal data on the Forrás Apartman website and when you book.
1. Data controller
PATHO-DIAG Könyvelő Betéti Társaság (registered office: 1162 Budapest, Kendermag utca 62., Hungary; company registration number: 01-06-771672; tax number: 21088469-1-42; represented by Tünde Szabó, managing director), operator of Forrás Apartman (8184 Balatonfűzfő-Fűzfőgyártelep, Bugyogóforrás utca 18., ground floor 3; NTAK registration number: EG26129270). Contact for privacy matters: info@forras-apartman.hu, phone: +36 70 618 6720.
2. What data we process, why and on what legal basis
Booking request: name, e-mail address, phone number, requested dates, number of guests and your message; purpose: processing and confirming the booking and communicating about your stay; legal basis: conclusion and performance of a contract (GDPR Art. 6(1)(b)). Guest identity document data at check-in; purpose: the statutory guest register, reporting to the Hungarian National Tourism Data Supply Centre (NTAK) and the local tourism tax return; legal basis: legal obligation (GDPR Art. 6(1)(c)). Newsletter: e-mail address; purpose: sending offers and news; legal basis: your consent (GDPR Art. 6(1)(a)), given via the confirmation e-mail and revocable at any time through the unsubscribe link in every message. E-mail enquiries: the data you include; purpose: answering your request; legal basis: steps taken at your request and our legitimate interest (GDPR Art. 6(1)(f)). Technical log data (IP address, timestamp, browser); purpose: secure operation of the website and abuse prevention; legal basis: our legitimate interest. Card payment: payment identifiers (transaction ID, amount, booking or order reference), the transaction data returned by the bank (authorisation number, response code, response text), and the customer's name and e-mail address; purpose: processing and confirming the payment, handling complaints and keeping accounting records; legal basis: performance of a contract (GDPR Art. 6(1)(b)) and compliance with a legal obligation (GDPR Art. 6(1)(c)). You enter your card details (card number, expiry date, security code) only on the payment page of CIB Bank Zrt.; we have no access to them and do not store them.
3. Cookies and analytics
Cookies strictly necessary for the website (session, storing your cookie choice) are used without consent. Visitor analytics (Google Analytics 4) start only if you accept them on the cookie banner; if you decline or make no choice, no analytics cookie is set. You can withdraw consent by deleting the cookies in your browser. Forms are protected against automated submissions by Cloudflare Turnstile, which sets no tracking cookie.
4. How long we keep your data
Booking and invoicing data are kept for the period required by accounting law (accounting documents for 8 years). Guest register and NTAK reporting data are stored for the period prescribed by law. Newsletter subscriptions are processed until you unsubscribe. Technical logs are kept for a short time, as needed for security. Data of booking requests that do not result in a stay are deleted within a reasonable time after our reply.
5. Who has access to your data
Your data are handled by the controller's staff and by the following processors, to the extent needed to provide the service: Vercel Inc. (website hosting), Neon Inc. (database), Resend Inc. (system e-mails), RackForest Kft. (mailboxes and domain), Google Ireland Ltd. (analytics, only with your consent), Cloudflare Inc. (form protection), CIB Bank Zrt. (registered office: 1024 Budapest, Petrezselyem utca 2–8., Hungary; company reg. no.: 01-10-041004; processing card payments: receiving the transaction data, collecting card details on the bank's payment page, authorisation with the card issuing bank and the related customer authentication (3D Secure)). Calendar synchronisation with Booking.com and szallas.hu exchanges booked periods only, no personal data. Where a provider is located outside the European Economic Area, transfers rely on the European Commission's standard contractual clauses or an adequacy decision. Where required by law we transmit data to the National Tourism Data Supply Centre (NTAK) and the municipal tax authority.
6. Your rights
You may request access to your personal data, their rectification, erasure or restriction of processing, exercise your right to data portability, object to processing based on legitimate interest, and withdraw your consent at any time. Send your request to info@forras-apartman.hu; we reply within 30 days at the latest.
7. Remedies
If you believe that the processing of your data infringes the law, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9-11.; postal address: 1363 Budapest, Pf. 9.; ugyfelszolgalat@naih.hu; +36 1 391 1400) or bring the matter before a court.
Effective from 23 September 2026. Changes to this policy are published on this page.