Data controller details

Name of the data controller: PolgárBor Kft.
Registered office: 7773 Villány, Rákóczi ut 32.
Company registration number: 02-09-066205
Tax number: 11768490-2-02
E-mail: csilla.varga@polgarpince.hu
Phone number: 06707703150
Website: www.polgarpince.hu
Managing director: Polgár Zoltán ügyvezető
Person responsible for data protection: Varga Csilla general manager

This notice applies to data processing activities carried out by the data controller, in particular in connection with the following activities:

1. Processing of guest personal data in connection with accommodation services

Legal basis for processing: GDPR Article 6(1)(c) – compliance with a legal obligation

Legal references:

• Act CLVI of 2016 on the state tasks related to the development of tourist regions, Section 9/H(1)
• Government Decree 235/2019 (X. 15.) on the implementation of the Act on the state tasks related to the development of tourist regions
• Civil Code (Ptk.) Section 6:22
• Local government decree 17/2015 (XI. 27.) of the Representative Body of Villány Municipality on local taxes

Retention period:

• in the VIZA system: 2 years
• in the accommodation register: 5 years

Tourism hosting provider: Visit Hungary Nemzeti Turisztikai Szervezet Nonprofit Zártkörűen Működő Részvénytársaság (registered office: 1123 Budapest, Alkotás utca 19., company registration number: 01 10 049807, tax number: 26338783-4-43, e-mail: info@visithungary.com)

guest: the natural person who actually uses the accommodation service and is temporarily accommodated at the accommodation, regardless of the person who pays for the accommodation service

Recipients or persons authorised to access the personal data: Your data may be accessed by those employees of the data controller who handle them in the course of their duties in connection with guest registration administration.

Data processor: The data controller uses accommodation management software, the operator of which acts as a data processor: Previo.hu Kft. (registered office: 1119 Budapest, Petzvál József utca 4. a. ép., tax number: 27786330-2-43, company registration number: 01 09 397840, represented by: Pavel Kotas, Jákri Zsolt ügyvezetők, contact: info@previo.hu)

2. Processing of data related to invoices issued by the data controller to natural persons

Legal basis for processing: GDPR Article 6(1)(c) – compliance with a legal obligation

Retention period: 8 years

Recipients or persons authorised to access the personal data: Your data may be accessed by those employees of the data controller who handle them in the course of their duties in connection with the issuance and administration of invoices. The data controller forwards invoices and supporting documents to the data processor performing accounting tasks.

Data processor: The data controller engages a data processor for the issuance of invoices and to fulfil its statutory obligations relating to accounting and taxation. Data processor: CATILLA Kft. (registered office: 7635 Pécs Oldal Dűlő 16/A, tax number: 13587011-2-02, company registration number: 02 09 070350, represented by: Kemenesné Tillai Katalin ügyvezető) accountant; Data processor: KBOSS.hu Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság (KBOSS.hu Kft.), registered office: 1031 Budapest, Záhony utca 7., representative: Ángyán Balázs ügyvezető, company registration number: 01-09-303201, tax number: 13421739-2-41, E-mail: info@szamlazz.hu) invoicing software provider

3. Processing of data related to non-cash payment transactions of data subjects

Legal basis for processing: GDPR Article 6(1)(b) – performance of a contract

Retention period: 5 years from the date of the payment transaction

Legal reference: Civil Code (Ptk.) Section 6:22 (general limitation period)

Recipients or persons authorised to access the personal data: Your data may be accessed by those employees of the data controller who handle them in the course of their duties in connection with payment transaction administration, as well as by the data processor.

Data processor: The data controller engages a data processor to ensure the data communication required for online payment transactions between the electronic systems of the data controller and the payment service provider, in order to confirm the status of the transaction. Data processor: OTP Bank Nyrt. (registered office: 1051 Budapest, Nádor u.16., tax number: 10537914-4-44, company registration number: 01 10 041585, contact: informacio@otpbank.hu); OTP Pénztárszolgáltató Zrt. (registered office: 1138 Budapest, Váci út 135-139. A. ép. 3. em., tax number: 13272346-4-41, company registration number: 01 10 045076, contact: info@otppsz.hu); K&H Bank Zrt. (registered office: 1095 Budapest, Lechner Ödön fasor 9., tax number: 10195664-4-44, company registration number: 01 10 041043, contact: bank@kh.hu); MBH Bank Nyrt. (registered office: 1056 Budapest, Váci u. 38., tax number: 10011922-4-44, company registration number: 01 10 040952, contact: ugyfelszolgalat@mbhbank.hu)

4. Processing of data in connection with a specific quotation request received from the data subject (accommodation services / event organisation)

Legal basis: GDPR Article 6(1)(a) – consent

Retention period: until consent is withdrawn

We inform you that you are entitled to withdraw your consent at any time, without restriction or justification and free of charge, through any of the contact details set out in the section entitled "Data controller details" of this privacy notice. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. If you withdraw your consent, the data controller may no longer process the personal data recorded and stored for the purpose of contact in connection with the specific quotation request, and therefore will not be able to respond to the quotation request or provide a quotation. We inform you that by sending a quotation request to our contact details, you express your voluntary consent to the processing of your personal data for this purpose.

Recipients or persons authorised to access the personal data: Your data may be accessed by those employees of the data controller who handle them in the course of their duties in connection with the administration of specific quotation requests relating to the services of the data controller.

Data processor: The data controller engages a data processor to operate the online quotation request module, store incoming online quotation requests in a closed system, and enable responses to quotation requests. Data processor: OnyxDev Kft. (registered office: 6772 Deszk, Béke utca 43. A. ép., tax number: 32188439-2-06, company registration number: 06 09 028520, represented by: Csík Patrik ügyvezető)

5. Processing of personal data related to accommodation bookings and ordered events

Legal basis: GDPR Article 6(1)(b) – performance of a contract

Retention period: 5 years from the performance of the contract

Legal reference: Civil Code (Ptk.) Section 6:22 (general limitation period)

Recipients or persons authorised to access the personal data: Your data may be accessed by those employees of the data controller who handle them in the course of their duties in connection with the administration of accommodation bookings and events.

Data processor: in the case of online booking, the hosting provider of the booking system, which operates the online booking system via its server, enables the sending of confirmations and the operation of the guest review system. Hosting provider: Nethely Kft., registered office: 1115 Budapest, Halmi utca 29., e-mail: info@nethely.hu, company registration number: 01-09-961790, tax number: 23358005-2-43; The data controller uses accommodation management software, the operator of which acts as a data processor: Previo.hu Kft. (registered office: 1119 Budapest, Petzvál József utca 4. a. ép., tax number: 27786330-2-43, company registration number: 01 09 397840, represented by: Pavel Kotas, Jákri Zsolt ügyvezetők, contact: info@previo.hu)

6. Registration for events organised by the data controller

Legal basis: GDPR Article 6(1)(a) – consent

Retention period: until consent is withdrawn

We inform you that you are entitled to withdraw your consent at any time, without restriction or justification and free of charge, through any of the contact details set out in the section entitled "Data controller details" of this privacy notice. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. If you withdraw your consent before the date of the event, the data controller may no longer process the personal data recorded and stored for the purpose of ensuring your participation in the event organised by the data controller, and therefore you may not be able to participate in the event organised by the data controller. We inform you that by submitting your registration for the event to the data controller, you express your voluntary consent to the processing of your personal data for this purpose.

Recipients or persons authorised to access the personal data: Your data may be accessed by those employees of the data controller who handle them in the course of their duties in connection with the organisation and conduct of events.

Data processor: in the case of online registration, data processor: OnyxDev Kft. (registered office: 6772 Deszk, Béke utca 43. A. ép., tax number: 32188439-2-06, company registration number: 06 09 028520, represented by: Csík Patrik ügyvezető)

7. Photo and video recordings made at events

Legal basis: GDPR Article 6(1)(f) – legitimate interest

Legitimate interest: The legitimate interest of the data controller is to promote its services and events, business communication and marketing, brand building and strengthening its online presence. A copy of the balancing test may be requested through the contact details set out in the section entitled "Data controller details" of this privacy notice.

Recipients or persons authorised to access the personal data: Your data may be accessed by those employees of the data controller who handle them in the course of their duties in connection with the organisation and conduct of events, as well as by visitors to the website and social media platforms of the data controller.

8. Processing of data related to any information request initiated by the data subject concerning the services provided by the data controller / use of the contact form

Legal basis: GDPR Article 6(1)(a) – consent

Retention period: 1 year

We inform you that you are entitled to withdraw your consent at any time, without restriction or justification and free of charge, through any of the contact details set out in the section entitled "Data controller details" of this privacy notice. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. If you withdraw your consent, the data controller may no longer process the personal data recorded and stored for the purpose of your information request, and therefore may not be able to respond to your information request. We inform you that by sending an information request to our contact details, you express your voluntary consent to the processing of your personal data for this purpose.

Recipients or persons authorised to access the personal data: Your data may be accessed by those employees of the data controller who handle them in the course of their duties in connection with the administration of information requests received from data subjects.

Data processor: operator of the www.polgarpince.hu website. OnyxDev Kft. (registered office: 6772 Deszk, Béke utca 43. A. ép., tax number: 32188439-2-06, company registration number: 06 09 028520, represented by: Csík Patrik ügyvezető)

9. Processing of data related to complaints, claims and compensation requests from data subjects

Legal basis: GDPR Article 6(1)(f) – legitimate interest

Legitimate interest: It is in the legitimate interest of both the data controller and the data subject that complaints, claims and compensation requests submitted by the data subject can be investigated, thoroughly examined and resolved as a result of the investigation. A copy of the balancing test may be requested through the contact details set out in the section entitled "Data controller details" of this privacy notice.

Retention period: 5 years from the submission of the complaint, claim or request

Legal reference: Civil Code (Ptk.) Section 6:22 (general limitation period)

Recipients or persons authorised to access the personal data: Your data may be accessed by those employees of the data controller who handle them in the course of their duties in connection with the administration of complaints, claims and compensation requests. In the event of legal enforcement, your data may also be accessed by the legal representative of the data controller and the authority handling the case.

10. Processing of data related to marketing activities (newsletter, promotions, guest discounts, loyalty programme)

Legal basis: GDPR Article 6(1)(a) – consent

Retention period: until consent is withdrawn

We inform you that you are entitled to withdraw your consent at any time, without restriction or justification and free of charge, through any of the contact details set out in the section entitled "Data controller details" of this privacy notice. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. If you withdraw your consent, the data controller may no longer process the personal data recorded and stored for the purpose of sending newsletters/promotions, guest discount offers or participation in the loyalty programme, and therefore you may no longer receive news, promotions or guest discounts from the data controller, participate in the loyalty programme or use discounts. We inform you that by subscribing to the newsletter, subscribing to news about promotions and guest discounts, or registering for the loyalty programme, you express your voluntary consent to the processing of your personal data for this purpose.

Recipients or persons authorised to access the personal data: Your data may be accessed by those employees of the data controller who handle them in the course of their duties in connection with the administration of newsletters, promotions, guest discounts and the loyalty programme.

Data processor: the data controller engages a data processor to operate the newsletter system. OnyxDev Kft. (registered office: 6772 Deszk, Béke utca 43. A. ép., tax number: 32188439-2-06, company registration number: 06 09 028520, represented by: Csík Patrik ügyvezető). We use Brevo (Sendinblue SAS) for the technical delivery of newsletters.

11. Processing of data related to contracts with natural persons who are not guests (e.g. supplier, performer, wine cellar rental)

Legal basis:

• GDPR Article 6(1)(b) – performance of a contract
• GDPR Article 6(1)(c) – compliance with a legal obligation [Act CXXVII of 2007 (Áfa tv.), Act C of 2000 Section 169 (Számviteli tv.)]

Retention period: 8 years

Recipients or persons authorised to access the personal data: Your data may be accessed by those employees of the data controller who handle them in the course of their duties in connection with the administration of contracts with natural persons who are not guests. In the event of legal enforcement, your data may also be accessed by the legal representative of the data controller and the authority handling the case.

12. Processing of data relating to natural person contact persons designated by corporate partners under contract

Legal basis: GDPR Article 6(1)(f) – legitimate interest

Legitimate interest: The legitimate interest of the data controller is to maintain effective contact with its business partners, conduct the consultations necessary for concluding contracts, and ensure contact during the performance of contracts. A copy of the balancing test may be requested through the contact details set out in the section entitled "Data controller details" of this privacy notice.

Retention period: 8 years

Legal reference: Számviteli tv.

Recipients or persons authorised to access the personal data: Your data may be accessed by those employees of the data controller who handle them in the course of their duties in connection with the administration of contracts with natural persons who are not guests. In the event of legal enforcement, your data may also be accessed by the legal representative of the data controller and the authority handling the case.

13. Privacy notice for job applicants

Legal basis for processing: during the selection process: GDPR Article 6(1)(b) – steps prior to entering into a contract; in relation to the talent pool – for offering future job opportunities: GDPR Article 6(1)(f) – legitimate interest of the data controller.

Legitimate interest: The legitimate interest of the data controller is to contact suitable applicants who have previously applied in the event of future job opportunities, to increase the efficiency of the selection process, and to fill future positions more quickly and cost-effectively. The legitimate interest of the data subject is to be informed about relevant job opportunities and to apply for newly available positions. A copy of the balancing test may be requested through the contact details set out in the section entitled "Data controller details" of this privacy notice.

Retention period:

• during the selection process: until the process is closed
• data of rejected applicants: for a maximum of 6 months (due to potential legal disputes)
• in the case of the talent pool: for a maximum of 2 years

Recipients or persons authorised to access the personal data: Your data may be accessed by those employees of the data controller who handle them in the course of their duties in connection with recruitment and talent pool administration.

The data controller informs you that, based on the 2016 guidance of the Nemzeti Adatvédelmi és Információszabadság Hatóság on the fundamental requirements of workplace data processing, during the recruitment process the data controller may become aware of publicly available personal data published on social media by the applicant for the position in question, which are relevant from the perspective of employment. In this connection, we further inform you that the company advertising the job vacancy does not download, store or transfer personal data in connection with the applicant's social media profile.

14. CCTV surveillance on the premises of Polgár Pincészet and Polgár Elixír Hotel

Legal basis for processing: GDPR Article 6(1)(f) – legitimate interest

Legitimate interest: The legitimate interest of the data controller is to ensure the protection of the facilities and equipment it operates, safeguard assets and business and payment secrets, guarantee the personal and property security of employees, guests and other data subjects, prevent, detect and investigate unlawful acts, provide evidence for authority or court proceedings where necessary, and monitor employee conduct related to employment to ensure lawful operation. A copy of the balancing test may be requested through the contact details set out in the section entitled "Data controller details" of this privacy notice.

Retention period:

• generally 30 days
• in the event of an extraordinary incident, if proceedings related to an unlawful act are initiated, until the end of the proceedings

The data controller informs you that it does not use cameras or surveillance in premises where this could violate human dignity, in particular in restrooms, guest rooms, changing rooms, showers, designated break areas, and monitors only those areas operated by the data controller itself; the camera's field of view does not extend to public space. CCTV surveillance is not focused on a specific individual; the cameras' field of view is directed at areas consistent with the purpose of processing.

Location of cameras on the premises of Polgár Pincészet and Polgár Elixír Hotel:

• Above the left side of the reception desk, directed at the reception counter
• Above the left side of the lift, directed towards the lobby
• Above the reception entrance, directed towards the white main gate
• Above the terrace, directed towards the vehicle entrance
• From the corner of the restaurant, directed towards the dining tables
• On the wall of the Knight's Hall (cellar), directed towards the tables
• On the kitchen wall, directed towards the processing area
• On the wall of the cold storage room, directed towards the refrigerators

Recipients or persons authorised to access the personal data: Your data may be accessed by the general manager of the data controller and the employee designated by them.

Data processor: The data controller engages a data processor to operate the cameras. Data processor: Power Alarm Kft. (registered office: 7773 Villány, Batthyány utca 37., tax number: 22987196-2-02, company registration number: 02 09 076420, represented by: Bock Szilárd ügyvezető, contact: bock.szilard@bocksound.com)

15. Data processing on the website of the data controller

Legal basis for processing: GDPR Article 6(1)(a) – consent

Retention period: Cookies: 5 years from acceptance of the cookie. Server logs: 90 days, after which they are automatically deleted.

The data controller informs you that it uses cookies on its website to improve the user experience. Cookies are small text files stored by your browser on your device.

Types of cookies used:

• Strictly necessary cookies: Ensuring the basic functions of the website.
• Performance cookies: Analysis of website usage, visitor statistics.
• Functional cookies: Remembering your preferences.

You may delete cookies at any time in your browser settings or withdraw your consent. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Data processor: the data controller engages a data processor to operate its website. OnyxDev Kft. (registered office: 6772 Deszk, Béke utca 43. A. ép., tax number: 32188439-2-06, company registration number: 06 09 028520, represented by: Csík Patrik ügyvezető)

Rights of data subjects in relation to the processing of their personal data

• Right to information: You are entitled at any time to receive appropriate information about the processing of your personal data, in writing or verbally, based on your substantiated request. Appropriate information must be provided within one month of the request (with a possible extension of up to two months). No fee may be charged for this.
• Right of access: You may at any time request confirmation as to whether your data are being processed, what types of data are processed (if you did not provide the data directly), to whom and where they will be transferred, how long they will be stored, etc., i.e. all information relating to your personal data, including information on automated decision-making and profiling. Upon request, you may also obtain a copy of the data.
• Right to rectification: You may request the correction of inaccurately or incompletely recorded data within a reasonable time.
• Right to erasure: You may request that your data be deleted from the database within a reasonable deadline if they are no longer necessary for the purpose for which they were collected, if you withdraw your consent to processing, if you object to the processing of your data, or if your data were processed unlawfully. (You may not request erasure of your personal data if processing is required to comply with a legal obligation.)
• Right to restriction of processing: If you dispute, for any reason, that your data are being processed appropriately, you may restrict the use of your data until the matter is clarified.
• Right to object: You may at any time object to the processing of your data, in which case the data controller may no longer process your data.
• Right to lodge a complaint: If you have any objection regarding the processing of your data, you may lodge a complaint with the competent authority: Nemzeti Adatvédelmi és Információszabadság Hatóság, 1055 Budapest, Falk Miksa utca 9-11, phone: +36(30) 683-5969; +36 (30) 549-6838; +36 (1) 391 1400, www.naih.hu, ugyfelszolgalat@naih.hu, official portal short name: NAIH, KR ID: 429616918.
• Right to judicial remedy: If your rights relating to the processing of your data are infringed, you are entitled to seek remedy before a court.
• Right to data portability: If you so request, you may receive your data on an electronic data carrier, or request that the data controller transmit them to another data controller.

By giving consent to data processing, you declare that your statement is made voluntarily and free from any undue influence, that it is specific and based on appropriate information, and that in connection with the processing of your personal data the data controller has made the privacy notice available to you and you have read and acknowledged its contents. You are entitled to refuse to give consent and to withdraw the consent you have given at any time. Withdrawal of consent does not affect the lawfulness of consent previously given. You may withdraw your consent either in person or by sending a request to the data controller by electronic or postal mail, or by unsubscribing from the newsletter in the manner indicated in the newsletter.

Automated decision-making

No automated decision-making or profiling based on your data takes place during data processing.

Data security

To protect your personal data, paper-based documents are stored locked in a secure location; only employees with the appropriate authorisation may access your electronically stored data on the data controller's server. The data controller applies technical measures that prevent unauthorised access to data and prevent data loss and damage.

Data transfer

No data are transferred to third countries outside the EU or to international organisations.

The data controller may transfer personal data in the following cases:

• on the basis of a legal obligation (e.g. NTAK, tax authority, local government)
• NTAK/VIZA: Magyar Turisztikai Ügynökség Zrt. 1027 Budapest, Kacsa u. 15-23.; 1525 Budapest, Postafiók 97.; Telefon: +36 1 488 8700; E-mail cím: info@mtu.gov.hu
• upon request from an authority (e.g. police, court)
• to data processors (e.g. accounting, IT service providers)
• to the payment service provider in the case of card payment

Data processors

The data controller may engage data processors to the extent necessary for its operations, for example:

• accountant
• invoicing software provider
• hosting provider
• website operator
• newsletter system
• payment service provider
• accommodation management software
• technical service providers connected to NTAK/VIZA systems

The data controller engages only data processors that provide adequate guarantees for processing in accordance with the GDPR.

Additional data processors beyond those named in this notice:

• Winery excise duty programme, SQL server operator: RHINO COMPUTER Kft. (registered office: 9600 Sárvár, Tilosalja u 11., tax number: 12356937-2-18, company registration number: 18 09 104388, represented by: Nagy József ügyvezető, contact: rhinokft@rhinokft.hu)
• Google Ireland Limited – Registered office: Gordon House, Barrow Street, Dublin 4, Ireland
• Facebook / Instagram / Meta Platforms Ireland Limited – Registered office: Merrion Road, Dublin 4, Ireland
• Booking.com: Booking.com B.V. – Registered office: Oosterdokskade 163, 1011 DL, Netherlands
• Szállás.hu: Szallas Group Zrt. (registered office: 3525 Miskolc, Régiposta utca 9., e-mail: privacy@szallas.hu, tel.: +36 30 344 2000, company registration number: 05-10-000701, tax number: 32362903-2-05)
• Utazzitthon.hu: Utazzitthon.hu Kft. (registered office: 2161 Csomád, Levente utca 14/A., tax number: 14190551-2-13, company registration number: 13 09 207341, contact: info@utazzitthon.hu)

Amendments to this notice

The data controller reserves the right to amend this notice. The amended notice takes effect on the date of its publication on the website.

Effective date: 10 April 2026