Privacy Policy

Last updated: June 3, 2026

This Privacy Policy sets forth the rules governing data processing in connection with the use of the website of Erglis Property Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság (Tax ID: 27477551-2-41). Information regarding the processing of data related to cookies used on the site is contained in a separate Cookie Policy.

I. Identification of the Data Controller, Definition of Personal Data and Data Subject

The Data Controller is the legal entity that determines the purposes and means of processing personal data, either independently or jointly with others.

For the purposes of this policy, personal data means any information relating to an identified or identifiable natural person (the Data Subject). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier (such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person).

II. Legislation Governing This Privacy Policy

The main laws governing data processing under this policy are as follows:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation / GDPR)
• Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (Infotv.)
• Act V of 2013 on the Civil Code

III. Specific Purposes of Data Processing

1. Boat Reservation / Contact Enquiry

a) Legal basis for the data controller's data processing

In the case of personal data voluntarily submitted by applicants, Article 6(1)(a) of the GDPR applies, according to which personal data may be processed where the data subject has given consent to the processing of his or her personal data for one or more specific purposes. Individuals interested in booking the company's boat provide their personal data and give their consent by accepting the declaration posted on the website.

b) Personal data processed

Name, email address, phone number.

c) Transfer of personal data to a third country or an international organization

The Data Controller does not transfer personal data to third countries or international organizations.

d) Purpose of data processing

The purpose of data processing is for the Data Controller to coordinate the details of the boat reservation, enter into a contract with the guest, and subsequently fulfill it, as well as to provide personalized information to interested parties.

e) Duration of data processing

Data processing continues until the contract is concluded.

f) Data security

The Data Controller's IT department is responsible for the security of data processing. Automated decision-making — including profiling — is not used during data processing.

g) Data processors

A data processor is a natural or legal person who processes personal data on behalf of the Data Controller.

No data processors are used in the course of this data processing beyond the technical transmission service described in section (c) above.

IV. Rights Related to Data Processing and Remedies

1. Rights Related to Data Processing

a) The Data Subject may request the following from the Data Controller:

• information regarding the processing of their personal data (prior to the commencement of data processing and during data processing),
• access to their personal data (the provision of their personal data by the Data Controller),
• the rectification or supplementation of their personal data,
• the erasure or restriction of their personal data,
• the right to object to the processing of their personal data.

b) The Data Subject may submit a Data Subject request to the Data Controller using the contact details specified in Section I. The Data Controller shall comply with the Data Subject's lawful request within a maximum of one month (taking into account the complexity of the request and the number of requests, this deadline may be extended by an additional two months in justified cases) and shall notify the Data Subject thereof at the contact details provided by the Data Subject.

a) The Right to Request Information (pursuant to Articles 13–14 of the GDPR)

The Data Subject may request information in writing from the Data Controller regarding:

• what personal data is being processed,
• on what legal basis,
• for what purpose,
• from what source,
• for how long,
• whether a data processor is used; if so, the name and address of the data processor and the activities related to data processing,
• to whom, when, and under what legal basis the Data Controller granted access to which personal data, or to whom it transferred the personal data,
• the circumstances and effects of any data protection incident, and the measures taken to address it.

b) Right of Access (pursuant to Article 15 of the GDPR)

The Data Subject has the right to receive confirmation from the Data Controller as to whether personal data concerning him or her are being processed, and if such processing is taking place, the Data Subject has the right to access the personal data being processed and may request this in writing from the Data Controller.

The Data Controller shall provide the Data Subject with a copy of the personal data subject to processing. If the Data Subject submitted the request electronically, the information must be provided in a commonly used electronic format, unless the Data Subject requests otherwise.

c) Right to Rectification and Completion (pursuant to Article 16 of the GDPR)

The Data Subject may request in writing that the Data Controller modify or correct any of their personal data (for example, they may change their email address or mailing address at any time, or request that the Data Controller correct any inaccurate personal data processed by the Data Controller).

Taking into account the purpose of the data processing, the Data Subject has the right to request that the Data Controller appropriately supplement any incomplete personal data processed by the Data Controller.

d) Right to Erasure (pursuant to Article 17 of the GDPR)

The Data Controller processes personal data in accordance with applicable laws for the duration specified in this privacy notice.

The Data Subject has the right to request that the Data Controller erase personal data concerning him or her without undue delay, and the Data Controller is obligated to erase personal data concerning the Data Subject without undue delay if any of the following grounds apply:

• the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
• the personal data has been unlawfully processed;
• the personal data must be erased to comply with a legal obligation under a binding legal act of the European Union or under Union or Member State law to which the Controller is subject.

The data may not be erased if the processing is necessary:

• for the exercise of the right to freedom of expression and the right to information;
• to comply with a legal obligation under a binding legal act of the European Union or national law to which the Data Controller is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;
• on the basis of a public interest in the area of public health, in accordance with Article 9(2)(h) and (i) and Article 9(3) of the GDPR;
• in accordance with Article 89(1) of the GDPR, for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, insofar as the right to erasure is likely to render impossible or seriously impair such processing; or
• for the establishment, exercise, or defense of legal claims.

e) Right to Restriction of Processing (pursuant to Article 18 of the GDPR)

The Data Subject may request in writing that the Data Controller restrict the processing of their personal data if any of the following conditions are met:

• the Data Subject contests the accuracy of the personal data; in this case, the restriction applies for a period enabling the Data Controller to verify the accuracy of the personal data;
• the processing is unlawful, and the Data Subject opposes the erasure of the data and requests the restriction of their use instead;
• the Data Controller no longer needs the personal data for the purposes of processing, but the Data Subject requires it for the establishment, exercise, or defense of legal claims; or
• the Data Subject has objected to the processing pursuant to Article 21(1) of the GDPR; in this case, the restriction applies for as long as it has not been determined whether the Data Controller's legitimate grounds override those of the Data Subject.

If data processing is restricted on the basis of the above, such personal data may be processed, with the exception of storage, only with the Data Subject's consent, or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of substantial public interest of the European Union or of a Member State.

The Data Controller shall notify the Data Subject — whose data processing has been restricted at their request — in advance of the lifting of the restriction on data processing.

f) Right to Object (pursuant to Article 21 of the GDPR)

The Data Subject has the right to object to the processing of personal data based on the legitimate interests of the Data Controller (a third party), in which case the Data Controller may no longer process the personal data, unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the Data Subject, or which are related to the establishment, exercise, or defense of legal claims.

Where personal data are processed for direct marketing purposes, the Data Subject may at any time object to the processing of personal data concerning him or her for such purposes, including profiling to the extent that it is related to such direct marketing. In the event of such an objection by the Data Subject, the data may no longer be processed for such purposes.

2. Remedies Related to Data Processing

Initiating Legal Proceedings

The Data Subject may bring a lawsuit against the Data Controller (or, in connection with data processing operations falling within the scope of the data processor's activities — the data processor) if, in their opinion, the Data Controller or the data processor acting on its behalf or under its instructions processes their personal data in violation of the provisions set forth in legislation or in a binding legal act of the European Union regarding the processing of personal data.

The adjudication of the lawsuit falls within the jurisdiction of the court. The lawsuit may also be brought — at the Data Subject's discretion — before the competent court at the Data Subject's place of residence or domicile: http://birosag.hu/torvenyszekek

The Data Controller shall compensate for any damage caused by the unlawful processing of the Data Subject's data or by a breach of data security requirements; however, the Data Controller shall be exempt from liability if the damage was caused by an unavoidable cause outside the scope of data processing. The Data Controller shall not compensate for the damage to the extent that it resulted from the Data Subject's intentional or grossly negligent conduct. In the event of a violation of the Data Subject's right to privacy, the Data Subject may claim compensation for the harm suffered.

Initiating an Administrative Proceeding

The Data Subject may file a complaint with the National Authority for Data Protection and Freedom of Information (NAIH) to enforce their rights, citing that an infringement of their rights has occurred or is imminent in connection with the processing of their personal data, in particular:

• if, in their opinion, the Data Controller restricts the exercise of their rights as a Data Subject or rejects their request to exercise these rights (initiation of an investigation), and
• if, in their opinion, the Data Controller, or a data processor commissioned by or acting on the instructions of the Data Controller, violates the provisions governing the processing of personal data as set forth in legislation or in a binding legal act of the European Union (request for the initiation of an administrative proceeding).