Effective: Effective September 9, 2026. This notice provides clear and understandable information about the data processing activities carried out on Palov’s website, during the booking process, and in connection with the operation of the accommodation.
1. Data Controller and Contact Information
Data Controller: Katalin Sebestyén
Seat: 1125 Budapest, Diós árok 49/D.
Tax number: 52459515-1-43
Accommodation: Palov’s, 5540 Szarvas, Üdülő sétány 66.
NTAK registration number: MA23065246
General and customer service email: info@palovs.hu
Legal, Data Protection, and Regulatory Inquiries: management@palovs.hu
Telephone: +36 30 719 9488
2. Principles and Legal Bases of Data Processing
Palov’s processes data in a purpose-limited, necessary, transparent, and secure manner. We do not rely on general consent for the basic reservation data.
- Article 6(1)(b) of the GDPR: reservations, accommodation contracts, the purchase of gift certificates, and the fulfillment of ordered experience packages;
- Article 6(1)(c) of the GDPR: billing, accounting records, VENDÉGEM/VIZA, and other mandatory data reporting;
- Article 6(1)(f) of the GDPR: handling legal claims, ensuring IT security, preventing abuse, and safeguarding the operation of the service where warranted;
- Article 6(1)(a) of the GDPR: a separate, optional, non-pre-selected marketing consent, as well as consent for analytics and for loading Google Maps.
3. Reservations and Guest Relations
Objective: submitting quotes, contacting customers, recording, confirming, and fulfilling reservations, organizing arrivals and departures, and tracking payment status.
Data Processed: name, email address, phone number, arrival and departure times, number of guests, reservation and communication details, selected services, payment status, and any information voluntarily provided by the guest that is necessary to fulfill the reservation.
Please do not include health-related or other special-category data in the comment field unless it is absolutely necessary. Palov’s does not record phone calls.
When a reservation is made by phone or email, an agent involved in the operation of the accommodation facility may manually enter the necessary information into the reservation system. The representative may access the guest’s name, phone number, email address, arrival information, payment status, and tasks performed in VENDÉGEM to the extent necessary to fulfill the reservation.
4. Payments
4.1. Credit Cards and Stripe
Credit card payments are processed through the Stripe payment platform. Palov’s does not receive or store the guest’s full credit card number or CVC/CVV code. Palov’s may receive a transaction ID, payment status, amount, currency, date and time, and necessary technical data related to the payment.
When processing payments, Stripe acts as a data processor in accordance with Palov’s instructions; however, for certain of its own service, security, and legal purposes, it may act as a data controller. For EEA customers, depending on the specific role and service, Stripe Payments Europe Limited, Stripe Technology Company Limited, or the Irish entity Stripe Technology Europe, Limited—which is responsible for the payment service—may be involved. According to Stripe’s own privacy policy, data transfers outside the EEA are governed by an adequacy decision, the EU–U.S. Privacy Shield Framework, and standard contractual clauses; current details are as follows: Stripe Privacy Center, Stripe DPA and Stripe Data Transfers Addendum.
4.2. OTP SZÉP Card
For advance payments or other payments made with an OTP SZÉP Card, OTP’s own interface and system process the data required for the card payment. Palov’s manages the status and contact information necessary for coordinating reservations and payments; it does not process card information in its own system.
OTP’s official SZÉP Card Privacy Notice currently identifies OTP Bank Nyrt., located at 1051 Budapest, Nádor u. 16, as the data controller for the service. The current privacy notice: OTP SZÉP Card Privacy Notice.
5. Billing
Objective: Issuing, recording, and retaining invoices in accordance with the law.
Data Processed: billing name, address, email address, tax and billing information, and details regarding the service and payment.
Palov’s uses the Számlázz.hu system. According to the service provider’s official materials, the operator KBOSS.hu Trading and Services Limited Liability Company, with its registered office at 1031 Budapest, Záhony utca 7. The legal basis for processing billing data is Article 6(1)(c) of the GDPR. The following may assist with accounting tasks: Kis-Számadó Ltd., Szarvas. Accounting documents must be retained for at least 8 years.
6. GUEST, VISA, and NTAK
6.1. MY GUEST
Palov’s uses the VENDÉGEM Accommodation System. Guests’ identification information may be recorded in advance online or upon arrival; if recorded on-site, this is done by an authorized person involved in the operation of the accommodation facility. The official privacy policy of VENDÉGEM designates the Hungarian Tourism Agency Ltd. as the data controller for the application and NISZ Ltd. as the hosting provider for the system’s IT environment. See: VENDÉGEM Official Privacy Notice.
6.2. VISA
The legal basis for VIZA data processing is Article 6(1)(c) of the GDPR: legal obligation. The accommodation provider is the data controller for guest data; the Hungarian Tourism Agency, as a tourism hosting service provider, acts as a data processor with respect to the data transferred to VIZA. The accommodation provider retains guest data until the last day of the first year following the date on which it becomes aware of the data; thereafter, VIZA also deletes the data. Source: VIZA – Guests and VISA – FAQ.
6.3. NTAK
NTAK provides tourism and statistical data. Palov’s does not directly transmit personally identifiable guest data—such as names or ID numbers—to the NTAK statistical system. The role of NTAK and the privacy notice can be found at On the NTAK's official website is available.
7. Experience Packages and Partners
Gastronomy and wellness experience packages may include both in-house and third-party elements.
- FoxBear Deer: The guest's phone number may be shared for the purpose of coordinating delivery; the purpose is to coordinate and fulfill food delivery; the legal basis is Article 6(1)(b) of the GDPR.
- St. Clare Spa, Szarvas: The guest's name may be shared to identify the package; the purpose is to identify and fulfill the ordered package; the legal basis is Article 6(1)(b) of the GDPR.
Palov’s transmits only the data necessary for fulfillment and is responsible for packages containing its own items and those of its partners in accordance with the contract and applicable laws.
8. Gift Certificate
When purchasing a gift certificate, the following information may be processed: the purchaser’s name, email address, contact information, purchase and payment details, as well as the recipient’s name and contact information necessary for delivery. Objective: the issuance, delivery, recording, and redemption of vouchers, as well as customer relations. The legal basis for processing the purchaser’s data is the performance of the purchase contract, Article 6(1)(b) of the GDPR; for invoicing, Article 6(1)(c). The source of the recipient’s data is the purchaser; the legal basis for data processing is the legitimate interest in delivering the gift certificate and maintaining contact, Article 6(1)(f) of the GDPR. We will inform the recipient upon initial contact, but no later than one month after obtaining the data, in accordance with Article 14 of the GDPR. When redeeming the gift certificate, the recipient, as a guest, is the subject of data processing necessary for the performance of the contract, the legal basis for which is Article 6(1)(b) of the GDPR.
A gift certificate is not the same as a reservation for a specific date. The terms and conditions of the gift certificate provided at the time of purchase apply; the confirmation will include details regarding the amount, validity, redemption, and exceptions.
9. Marketing and Newsletter
The reservation is not contingent on providing marketing consent. During the reservation process, you may opt in to receive news, seasonal offers, and discounts via email by checking a separate, optional, and unchecked-by-default checkbox.
Separate newsletter sign-up and coupon (effective September 18, 2026): After you provide your name and email address and give your separate consent, we will send you a confirmation email. Your subscription will only become active after you click the link in the email (double opt-in). Confirmed subscribers will receive their own one-time accommodation discount code at the Subject to the terms and conditions set forth in the General Terms and Conditions. Unsubscribing does not invalidate coupons that have already been issued.
Operation and Data Processed: the name, the email address, subscription status, dates related to subscription and confirmation, and the technical identifiers required for confirmation and unsubscription are stored by the Newsletter plugin on Palov’s WordPress site on Sybell’s hosting server. Emails are sent through Palov’s mailing system. We do not transfer the subscriber list to a separate newsletter service. When handling IP addresses, we use the plugin’s anonymization setting.
Coupon Register: The code, the issuance and usage data, the subscriber’s internal ID, the version of the terms and conditions, and the encrypted hash of the email address serve to ensure that the one-time discount is honored and to prevent repeated use. The hash is pseudonymous data, not anonymous. The legal basis for redeeming the coupon is Article 6(1)(b) of the GDPR; the legal basis for preventing abuse is the legitimate interest under Article 6(1)(f). This record does not constitute a new marketing consent. Its retention is subject to the retention rules set forth in this notice regarding contractual and legal claims.
Technical cookie: The newsletter may use a cookie named „newsletter,” valid for up to one year, in connection with subscription-related operations to identify the subscriber and allow access to their subscription settings. This is necessary for the subscription to function properly.
Data processed: email address, the fact that consent was given, the date of consent, and the withdrawal of consent. Legal Basis: Article 6(1)(a) of the GDPR. Consent may be withdrawn at any time by using the unsubscribe option provided in the message or by management@palovs.hu can be revoked at any time. We do not share marketing consent data with partners or the recipient of the gift.
10. Website, Web Hosting, and Cookies
The website is WordPress-based, and reservations are processed by the WP Booking System hosted on the server. The hosting provider Sybell Informatika Limited Liability Company, 1138 Budapest, 34 Tomori Street, 2nd floor. Related service provider information: Sybell Hosting Terms and Conditions and Sybell Documents.
This website does not use Google Tag Manager, Meta Pixel, or TikTok Pixel. Google Analytics 4 is loaded only after consent has been given for analytics cookies. It is used to gain an overall understanding of website traffic, traffic sources, and page usage; it may process pseudonymous identifiers, pageviews, browser and device data, and approximate geographic data. According to the Analytics settings, Google Signals, user-provided data processing, enhanced measurement, and ad personalization are disabled; The standard Google Analytics settings apply to the collection of location and device data. Palov’s does not send the name, email address, or booking data provided in forms to Analytics. We remove query parameters and the on-page link portion from the measured page URLs; tracking is not enabled on the unique payment links used for booking payments. Event and user data are retained for 2 months, with activity-based renewal disabled. Google Analytics’ data processing role and safeguards for data transfers outside the EEA are governed by Google’s current terms and conditions: Google Privacy Policy and Google Data Processing Terms.
The font is provided by the website as a first-party resource. In the footer and on the contact page, Google Maps will only appear if the user explicitly loads it in advance; the map can be closed, and a standalone Google Maps link can also be used. For EEA users, Google services may be operated through Google Ireland Limited or an affiliated Google entity; for data processing outside the EEA, Google’s current contractual terms and data transfer mechanisms apply. The "Our Favorite Places" map uses local Leaflet tools and local mapping tools.
The CookieYes CMP is used on this website. According to CookieYes’s official privacy policy, the service provider CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom. The service may process masked IP data necessary for recording consent. Source: CookieYes Privacy Policy.
10.1. Cookies and Local Storage
| Cookie | Service Provider | Purpose and Category | Service Life |
|---|---|---|---|
cookieyes-* | CookieYes Limited / CookieYes | Managing cookie consent settings and consent status; an essential consent management feature. | 1 year. |
_ga, _ga_CNYVF92M7V | Google Analytics 4 | Analytical measurement after consent is given; analytical cookie. | 365 days. |
wpEmojiSettingsSupports | WordPress | Session-based management of the browser's emoji support; technical storage. | Until the end of the session. |
Elementor local storage facility | WordPress/Elementor | Local storage related to the website's operation. | There is no automatic expiration; it can be deleted in the browser. |
We ask for your separate consent to load Google Maps. Stripe may also use technical cookies necessary to securely process the credit card payment selected by the guest; these are independent of the analytics consent. You can find additional information from these third-party providers at the official links above.
11. Email and Communications Infrastructure
Palov’s is the info@palovs.hu and management@palovs.hu uses these addresses. Domain email operates on the Sybell infrastructure; emails are forwarded to Google's email service. This notice does not include specific internal email addresses. Google services may be provided by Google Ireland Limited or affiliated Google entities; data processing outside the EEA is subject to Google’s current contractual and data transfer terms.
Palov’s business website and database backups can also be stored on Google Drive. Only individuals with the access necessary for operations can access the backups.
12. Retention Periods
| Data Set | Preservation | Legal Basis |
|---|---|---|
| Reservation and Contract Information | For the duration necessary to fulfill the contract, and thereafter until the expiration of the general 5-year statute of limitations for legal claims, unless a longer mandatory period applies. | GDPR Article 6(1)(b), (f) |
| Billing and Accounting Information | At least 8 years. | Article 6(1)(c) of the GDPR |
| VISA Data | The accommodation provider retains the data until the last day of the first year following the date it becomes aware of the information; after that, VIZA also deletes it. | Article 6(1)(c) of the GDPR |
| NTAK Data Reporting | For the period specified in the relevant special rules. | Article 6(1)(c) of the GDPR |
| Complaints and Responses | 3 years. | GDPR Article 6(1)(c), (f) |
| Marketing | Until consent is withdrawn or the purpose ceases to exist; data confirming the withdrawal may be retained for as long as necessary to support legal claims. | GDPR Article 6(1)(a), (f) |
| Unsuccessful Inquiry | As a general rule, for up to 1 year, unless there are other reasons for retention. | Article 6(1)(f) of the GDPR |
| Cookies | Based on the actual shelf life of the cookie in question. | In accordance with the rules governing that cookie and the GDPR/ePrivacy Regulation |
13. Data Subject Rights
The data subject may request access, rectification, erasure, restriction of processing, and—subject to the conditions of the GDPR—data portability. The data subject may object to data processing based on legitimate interests. You may withdraw your consent to data processing based on consent at any time; this does not affect the lawfulness of data processing prior to withdrawal.
The application was submitted by the management@palovs.hu It may be sent to the address provided. Palov’s will provide a response without undue delay, but no later than one month from the date of receipt of the request. If necessary, this deadline may be extended by an additional two months, taking into account the complexity of the request and the number of requests received; we will notify you of this within the first month, stating the reason. The NAIH’s official guide to data subject rights: naih.hu/erintetti-jogok.
14. Legal Remedies
If the data subject believes that the data processing does not comply with the law, he or she may file a complaint with the National Authority for Data Protection and Freedom of Information or bring the matter before a court.
National Authority for Data Protection and Freedom of Information (NAIH)
Address: 9–11 Falk Miksa Street, 1055 Budapest.
Mailing Address: 1363 Budapest, P.O. Box 9.
Email: ugyfelszolgalat@naih.hu
Phone: +36 (1) 391 1400
Official Contact Information and Online Service Requests: naih.hu/ugyfelszolgalat-kapcsolat
15. Data Security and Automated Decision-Making
Palov’s protects data by restricting access, implementing contractual and technical measures with service providers, and applying the necessary data minimization. Palov’s does not engage in any fully automated decision-making or profiling that would have legal effects on the guest or similarly significantly affect them.
Palov’s does not use video surveillance and does not record phone calls.
16. Amendment
Palov’s may amend this privacy notice in accordance with actual data processing practices and changes in the law. The current version is available on this page. The booking terms and conditions are available at GTC, the rules for using the accommodation are set forth in the House rules includes.
17. Official Legal Sources
Primary sources related to the legal basis and retention rules for the information sheet: GDPR, Act C of 2000 on Accounting, Act CLV of 1997 on Consumer Protection and Act V of 2013 (Civil Code).