Villa Rosa

Privacy statement

Data Processing Information

in which you, as a visitor of our website and user of our services, are informed about the Data Protection Rules and Regulations of our company.

1. What principles are pursued?

  1. personal data are processed in a lawful and fair manner transparent for you,
  2. personal data are only collected for specified, explicit, and legitimate purposes and not further processed in a way not compatible with those purposes,
  3. personal data collected and managed are appropriate and relevant in terms of data processing purposes and these data are limited,
  4. all reasonable measures are taken in order to have the processed data accurate and if necessary up-to-date, and any inaccurate personal data are erased or corrected immediately,
  5. personal data are only stored in a manner no longer than is necessary for the purposes for which such personal data is processed,
  6. using appropriate technical or organisational measures personal data are processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and accidental loss, destruction or damage.

Your Personal Data 

  1. are collected, recorded, systematized, stored and used only on the basis of preliminary information provided and by your voluntary consent as strictly necessary and always with the relevant purpose,
  2. in certain cases the management of your personal data is based on the regulations of the law and compulsory, in which cases your attention is specifically drawn to this fact,
  3. in some cases the processing of your personal data is subject to the legitimate interest of our company or of a third party, for instance in the case of the operation and development and security of our website.

2. Who we are?

Company Name: Villa Rosa Hotel és Étterem Kft.
Address: 1029 Budapest, Ördögárok u. 174.
Phone: 06-1-99 88 174, 06-1-99 88 173
E-mail address:,
Tax Number: 25295203-2-41
Company Registration Number:  01 09 206766
According to Article 37. of the GDPR our company does not have to designate a data protection officer.
In data processing our company employs the following data processors:

  ITENT Informatikai Kft.
storage space providing
security technology services providing company
  Béta-Conto Könyvelő és Szolgáltató Kft.
accountancy/ bookkeeping
Google Google LLC
 Google Analytics


Data processors related to direct marketing and newsletter services

  ITENT Informatikai Kft.
storage space providing

Should there be any changes in the data processors employed these changes will be indicated in the current information guide.


Data processed by us:

Activity and purpose of data processing Legal basis Data processed Time limit
Website visit
The purpose is to ensure the proper and high-standard operation of the website,control and improvement of the quality of our services,identification of malevolent visitors attacking our website,measurement of website traffic,

statistical purposes

Legitimate interest of the company

IP address

time of visit

data of the sites visited,

the type of the operation system and browser you use

24  months
Business contacts via e-mail
requests and enquiries about services from the parties relevant
preparation of consent or contracts


e-mail address

phone number

6 months
Newsletter service
Purpose: Contact,Information about the new special offers and products

full name,

date of birth (to prove the coming of the age of 16 or 18)

e-mail address

other data which are not compulsory to provide, e.g. interests, permanent address, special offers etc. 

until you the unsubscribe  from the newsletter
Administration, complaints
attending to comments and complaints
legal obligation

full name

e-mail address

other data provided by the person concerned

5 years
Room booking preparing contracts, legal obligation

full name

invoice address

ID card number and date of expiry


2 months

Prize Competitions

Purpose: Making a positive impact on the business of the company by drawing the attention and by drawing valuable prizes increasing customer satisfaction. 


legal obligation

Depending on the competition:

  • full name
  • e-mail address
  • phone number
  • permanent address

in case of participants: until the end of the competition

in case of winners: for 8 years


We only ask for personal data from the visitors of our website if they would like to book, participate in a prize competition or subscribe for our newsletter or if they would like to receive personally tailored event offers.

Any enquiries regarding Data Processing you can ask for further information at:,

or by post sending your request to 1029 Budapest, Ördögárok u. 174.

Replies will be sent without delay, but within maximum 25 days to the contact address provided by you.


3. What cookies are and how they are handled.

Cookies are small files which get to your computer through the website by its usage via your Internet browser which saves and stores them. Most of the frequently used Internet browsers (Chrome, Firefox etc.) accept and allows the download and usage of cookies as a default configuration. But it is up to you if you allow or ban them by setting the browser. You can also erase the cookies which are on stored your computer. For further information about the usage of cookies contact “Help” page of the browser.   

There are essential cookies which do not require your preliminary consent, you will get a briefing about them at the beginning of your first visit on our website. They are for example the cookies for authentication, multimedia player, load balancing, work cookies for personal settings and the user-centred security cookies.

Our company informs you about the cookies that do not require consent at the first visit if the data processing begins then, and we ask for your consent.

Our company does not use and allow cookies with which a third party could collect personal data without your consent.

Accepting cookies is not compulsory, but our company cannot take the responsibility for the unsatisfactory operation of the website if cookies are not accepted.


What cookies are used?

Type Consent Description Purpose Validity
from a third party not necessary

Google Analytics

web tracking

service was used to identify new sessions and visitors

when visiting the website, visitors are connected to services of third parties (e.g.: Google services) 30 days

Information about third party cookies:  


4. Further information about data processing related to our website.

In the course of the personal contact with us you provide your personal data on a voluntary basis, so we would like to ask you to make sure you give the valid, right and accurate data, because you are responsible for them. Inaccurate, wrong or incomplete data can mean an obstacle to using our services.

If you provide another person’s personal data, we assume that you have the necessary authorisation to do so. 

You can withdraw your consent given for data processing free of charge at any time by the withdrawal of consent for personal data processing.  

For technical reasons the registration and submission of the withdrawal can be done within 10 days, but we would like to draw your attention, that in order to fulfil our legal obligations or to enforce our interests we can process some of your personal data after the withdrawal.  (Info tv. 6.§ (5), Eker tv. 13/A §, Számv tv. 169. § , Fogyv tv. 17/A §)

If misleading personal data are used, or if a visitor commits a crime or attacks our system, the registration of the visitor is immediately erased as well as all the personal data given, or – if necessary – we keep the data during the time of establishing civil legal liability or while the criminal procedure is conducted.


5. Data Processing for direct marketing and newsletters.

Modifying your personal data when requesting direct marketing and/or newsletter services (when you unambiguously express your intention of consent), you consent for the usage of your personal data for marketing purposes. In this case – until the consent is withdrawn – your personal data will be managed for direct marketing and/or newsletter sending and we can send you

  • advertising matters and other consignments
  • brochures and offers
  • and/or newsletters (Grtv. 6. §).

You can give your consent for both direct marketing and newsletters, or for either one, and you can withdraw any of them at any time free of charge.

Cancellation of the registration we always consider as the withdrawal of consent. Yet, the withdrawal of consent for data processing with the purpose of direct marketing and/or sending newsletters we do not consider as the withdrawal of the consent for personal data processing related to our web shop.

For technical reasons the withdrawal of each consent and the cancellations can be submitted only within 10 days.


6. What is to be known about our prize competitions?

For the purpose of campaigns our company can organise prize competitions, and the relevant conditions are listed in separate rules and regulations. The rules and regulations of the relevant competition can always be found on the home page of our website and can be reached through a direct link placed centrally. 


7. Other data processing issues

Your personal data can only be processed within the framework set by the law. In case of our data processors we ensure with the conditions of the contracts that your personal data cannot be used for purposes conflicting your consent. The participants and employees of our company’s data processing are entitled to know your personal data to the preliminary set extent under the pain of the obligation of confidentiality. Further information about the data processors is to be read in point 2.

Our company can only process data abroad according to Article V. of GDPR and the relevant regulations of Infotv.

The law court, the public prosecutor’s office and other authorities can approach our company with the request for personal data. In that case we have to fulfil our obligation of information to the extent that is absolutely necessary to realise the purpose of the request.

Appropriate technical and other measures are used to protect your personal data and ensure their security, availability. Besides, we protect the data from an unauthorised access, modifications, damages, publication and any other illegal usage.

Within the framework of company structure measures in our building we control physical access, we continuously train our employees and keep the paper based documents locked up with the proper security. By technical measures we use encryption, password protection and antivirus software. However we would like to emphasise that data processing via the Internet cannot be regarded as safe data processing. Our company does everything to make the processes as secure as possible, but we cannot take full responsibility for the data processing through our website.


8. Your rights and possible means of redress

Regarding the Personal Data Processing you can

  • ask for information,
  • ask for the correction, alteration and completion of your personal data managed by us,
  • protest against personal data processing and can ask for the deleting of your personal data (except for the compulsory personal data processing),
  • seek redress at court,
  • make a complaint or start legal proceedings at the supervisory authority (

Supervisory Authority: Hungarian National Authority for Data Protection and Freedom of Information

  • Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c., Postal address: 1530 Budapest, Pf.: 5.
  • Phone: +36 (1) 391-1400, fax: +36 (1) 391-1410
  • E-mail:, website:


Upon your request we inform you about the following managed and processed by us or the processors commissioned by us:

  • your data,
  • the sources of your data,
  • the purpose of data processing and its legal basis and time limit, and if it is not possible, the aspects of setting the time limit,
  • the processors’ names and addresses and their activities related to data processing,
  • the circumstances and effects of data protection incidents and the measures to prevent and to avert them,
  • besides, in case of processing your personal data about the legal basis of the process and the addressee of the data.

Information is provided as soon as possible, but 25 days the latest after the submission of the request. Information is free of charge, except if you previously submitted a request for information about the same type of data in the current year. The payment you made is refunded if we managed the data illegally or if the request for information resulted in a correction. Providing information can only be refused in cases included in the law indicating the relevant article and by providing information about the means of redress or the possibility of turning to the authority.  

Our company informs you and everybody to whom the personal data were previously processed about the correction, blocking, marking or deleting of the personal data, except when the omitted information would not fringe your legal interests.

If we do not meet your request of correction, blocking or delete, within 25 days after reception of the request we inform you about the reasons of refusal in writing – or with your consent – in an electronic way, and we also inform you about the possibilities of redress or turning to the authority.

If you are against the processing of your personal data, the protest is examined as soon as possible, but the latest within 15 days after its submission, and we inform you about our decision in writing. If we find that your protest is rightful, we stop processing your data – including the previous data recording and processing – and we block the data, and inform everybody, to whom we previously processed the personal data mentioned in the protest and we are obliged to enforce the right to protest.

We refuse to meet the request if we can prove that the data processing is justified by rightful obligatory reasons which have priority over your interests, rights and freedom, or which are related to the submission, enforcement or protection of legal requests. If you do not agree with our decision, or if we fail to meet the 15-day deadline, after receiving the decision or within 30 days after the last day of the deadline you can go to court.

Judging data protection cases is to be done by the court. An action can be instituted at the court of the plaintiff’s permanent or temporary place of residence, which is subject to choice. A foreign citizen can turn to the authority of the place of living or work.

We would like to ask you, before going to the authority or to court with your complaint, please contact our company to have discussions and find a solution for the problem as soon as possible.


9. Main laws and regulations for our activity

  • EU 2016/79 GDPR about the personal data processing of natural persons
  • CXII. law about the right of self-determination about information and about the freedom of information (Info tv.)
  • V. law about the Civil Code (Ptk.)
  • CLV. law about consumer protection (Fogyv tv.)
  • CLXV. law about complaints and public service announcements (Pktv.)
  • XLVIII. law about the basic conditions of the economic advertising activity and its certain restrictions (Grtv.)


10. Amendment of the Data Processing Information

Our company reserves the rights to amend the above Data Processing Information, of which the people concerned will be properly informed. The information related to the Data Processing will be released on the following website:


Date: Budapest, 23rd May 2018