Privacy Notice and Process Description

for data processing related to The Kitchen Caters website operated by Kempinski Hotel Budapest ZRT.

Kempinski Hotel Budapest Zrt. (hereinafter: The Company or Data Controller), in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as GDPR), hereby informs you, by means of this information notice and process description, of all facts relating to the processing of your personal data. By participating in the process, you, as the data subject, will become a data subject in accordance with this process description.

Name and contact details of the Data Controller:

Name of Data Controller:
Kempinski Hotel Budapest Zrt.
Data Controller company registration number:
01-10-041234
Data Controller tax number:
10250378-2-41
Data Controller’s registered office:
1051 Budapest, Erzsébet tér 7-8.
Data Controller email address:
hotel.corvinus@kempinski.com

Individuals entitled to represent Data Controller:
Stephan Interthal – General Manager
René Frischknecht – Chairman of the Board of Directors
Jasmeet Sehmi – Vice Chairman of the Board of Directors
Xavier Destribats – Member of the Board of Directors

The (name and) contact details of the Data Controller’s Data Protection Officer:

Data Controller’s Data Protection Officer:
L-Tender Data Protection and Information Security Services Ltd.

Contact details of the Data Protection Officer: privacy.corvinus@kempinski.com

COOKIES USE

Description of the data management process:

The Company operates its own website, which can be accessed at https://www.kempinski.com/hu/hotel-corvinus-budapest. The website uses automatic data collection (cookies, Google Analytics, etc.).

Visitors to the website may access and navigate it through the use of small data files known as cookies, which the website places on and retrieves from visitors’ computer devices. Cookies are employed to ensure the website operates correctly, to enhance service efficiency, and to collect anonymous data for statistical analysis.

Cookies may be removed from the visitor’s device either automatically upon closing the browser or manually by the visitor, who can also configure their browser to disable cookie usage. The website remains accessible even if you have manually disabled cookies in your browser settings.

On the one hand, the website uses a unique, temporary “spublic” cookie to identify workflows, i.e. to determine whether the visitor is logged in to the website or not. The “spublic” cookie is therefore used to allow visitors to enter and leave the website. A “spublic” cookie is a temporary cookie that is automatically deleted from the visitor’s computer device when the browser is closed, or can be manually deleted by the visitor in the browser settings.

The following cookies are used to help us to determine the following statistical information about your visit to the website and the number of visitors to the website, collected for this purpose:

a Visitor has reached the website through a search engine, keyword or link (“utmz” cookie),
how many times the visitor has visited the website (“utmb” cookie),
how long the visitor has been on the website (“utma” and “utmv” cookies),
when the visitor first visited the website (“utma” and “utmv” cookies),
when the visitor last visited the website (“utmc” and “utmv” cookies).

In addition to the above, some cookies protect the website from being overloaded (“utmt” cookie), and some cookies used by Google Analytics also record the IP address of the visitor’s computer device for analytical, statistical and security purposes. The data is stored on the visitor’s IT device. The independent measurement and auditing of the website’s traffic and other web analytics data is facilitated by Google Analytics servers as an external service provider, using the cookies listed above. The Data Controller for the measurement data provides detailed information regarding the handling of such data on the website https://www.google.com/analytics/, while further information on Google’s privacy principles can be accessed via the link http://www.google.hu/intl/hu/policies/privacy/. The data transmitted from the website to Google Analytics servers cannot directly and exclusively identify the visitor but serves only to identify the IP address of the computer device.

By visiting the website and clicking the “Accept” button, the visitor consents to the Data Controller’s use of cookies, managed either by external service providers or by the Data Controller itself, for purposes related to the operation of the website, and to the potential recording of data and information as outlined in this policy, subject to the applicable settings.

Such data includes information about the visitor’s computer, generated during use of the website and recorded by the cookies employed on the website as a result of automatic technical processes. Data that is automatically recorded is logged by the system without any specific declaration or action by the user when the user visits or exits the website.

Depending on the settings, the saved data will not be associated with other personal user data and will be accessible only to the third-party cookie service provider (e.g., Google) and the Data Controller. The Visitor cannot be identified from this data.

Purpose of data processing:
Recording of visitor data during visits to the website in order to monitor the functioning of the service and prevent abuse.

Legal basis for processing:
The legal basis for processing is the data subject’s consent pursuant to Article 6(1)(a) of the GDPR

Scope of data processed:
the date, time, IP address of the user’s computer, the address of the page visited, the address of the page previously visited, the user’s operating system and browser

In the course of the processing, the data will be transferred to the following third parties under the indicated legal basis:

The Company does not transfer the data to third parties, but shall remind data subjects that the disclosure of personal data to courts and authorities may be required by law. If the Company is required by a court or authority to provide personal data in the course of legal proceedings, in fulfilment of its legal obligation, the Company is obliged to provide the requested data to the court or authority in question.

Personal data storage duration:
Personal data will be electronically processed by Company for 30 days from the date of visiting the website.

Fact of automated decision making:
No automated decision making is performed during the processing.

Rules on the exercise of data subject rights:
The Company informs you that, under the GDPR, you may, after verifying your identity, exercise the following rights:

request information about the processing of their personal data,
may request the rectification of your personal data,
may withdraw your consent to the processing,
may request the erasure of your personal data (under the conditions set out in Article 17(1) of the GDPR)
may request the restriction of the processing of your personal data,
exercise your right to data portability (if the processing is carried out by automated means).

Processing of data relating to requests for quotations and the performance of orders

Description of the data management process:

The Company has its own website, which can be found at:
http://www.thekitchencaters.com/

Through the website, individuals have the opportunity to request a quote and place an order.
When requesting a quote or placing an order, the following information must be provided: name, phone number, email address, company name, event description, number of participants, and event date.
After submitting the request, individuals receive an automatic confirmation email, followed by a confirmation or quotation from the TKC Manager.
The Data Controller stores the information electronically.

Purpose of data processing:
Fulfilling requests for quotations and orders received.

Legal basis for processing:
Article 6(1)(a) of GDPR, consent of the data subject.

Scope of data processed:
Name, phone number, e-mail address, company name, event description, number of participants, event date.

Indication of the data processors involved in the processing and the processing operation:
The Data Controller does not involve a data processor in the data processing.

In the course of the processing, the data will be transferred to the following third parties under the indicated legal basis:

Personal data storage duration:
In the case of a quote request, data is retained for 30 days after the inquiry.
In the case of an order, data is retained for 30 days after fulfillment.

Fact of automated decision making:
No automated decision making is performed during the processing.

Rules on the exercise of data subject rights:
The Data Controllers shall hereby inform you that, pursuant to the GDPR, you may, after verifying your identity, exercise the following rights in relation to the data processing:

request information about the processing of their personal data,
may request the rectification of your personal data,
may withdraw your consent to the processing,
may request the erasure of your personal data (under the conditions set out in Article 17(1) of the GDPR),
may request the restriction of the processing of your personal data,
may exercise your right to data portability.

***

The Company shall ensure the security of the data, and shall take all technical and organisational measures necessary to enforce the GDPR and other data protection and confidentiality rules. The Company shall protect the data against unauthorised access, alteration, disclosure, disclosure, deletion or destruction and against accidental destruction or damage.

The Company will endeavour to ensure that the information provided to you is as concise, transparent, comprehensible, easily accessible, clear and understandable as possible, in all cases, while complying with the rules set out in the GDPR.

If you wish to exercise your rights under the GDPR for the purposes set out in this notice, you may make your request in writing, in particular to the Data Protection Officer at the contact details set out in this notice. However, if you request information orally, an authorised employee of the Company may, after verifying your relevance, provide you with the information orally, provided that the necessary data are available to him/her. In all other cases, the request will be recorded by our team member, and you will be informed of your request within one month of receipt of the request at the latest. If justified by the complexity of the application or the number of applications currently being processed, this deadline may be extended by a maximum of two additional months, but you will be informed electronically within one month of receipt of the application.

If we do not act on your request or if you do not accept our action, you can appeal. You may lodge a complaint about our data processing practices with the National Authority for Data Protection and Freedom of Information or, at your choice, with the competent court in your place of residence or domicile.

National Authority for Data Protection and Freedom of Information contact details

Address: 1055 Budapest, Falk Miksa u. 9-11.
Mailing address: 1363 Budapest, Pf.: 9.
Customer service (phone): +36 (30) 683-5969 and +36 (30) 549-6838
For more information about submitting request, please visit https://www.naih.hu