Privacy Notice for Security Camera Data Processing

Fort-Bau Zrt., the operator of Castellum Hotel Hollókő****, complies with the provisions of this notice. To ensure easier understanding, the controller also provides information to data subjects orally and without legal jargon.
Pursuant to Section 20 (1) of Act CXII of 2011 on Informational Self-Determination and Freedom of Information, and Section 28 (2) d) of Act CXXXIII of 2005 on the Rules Governing Security Services, Private Detective Activities and the Protection of Persons and Property, we provide the following information:

1. Purpose of data processing: In accordance with Section 31 (1) of the Act on the Protection of Persons and Property, the controller uses the surveillance system to protect property and to prevent and provide evidence of criminal offences, such as theft. The system makes it possible to detect infringements, increases the likelihood of catching offenders in the act and helps prevent unlawful conduct.

2. Legal basis for data processing: legitimate interest – Article 6 (1) f) of the GDPR

3. Categories of data processed: photographs and video recordings of the data subject

4. Retention period: Pursuant to Section 31 (2) of the Act on the Protection of Persons and Property, recorded images, audio recordings and audiovisual recordings must be destroyed or deleted no later than three working days after recording if they are not used. The controller deletes the recordings after 3 days (72 hours).

5. Recipients of personal data: Personal data may be accessed by the managing director of the controller and by designated employees.

6. Description of the legitimate interest: Our company has a legitimate interest in operating the cameras and recording their data. Infringements cannot be proven by other means, and the use of these technical devices is strictly necessary and does not result in a disproportionate restriction of the right to informational self-determination.

7. Categories of data subjects: employees of Fort-Bau Zrt. (hotel staff), hotel guests and, where applicable, other visitors.

8. Rights of data subjects in relation to data processing: Data subjects may request the deletion or rectification of their personal data by the following means:

• by post to 3176 Hollókő, Sport út 14.,
• by e-mail to castellum@hotelholloko.hu.

9. Operator of the electronic surveillance system: Fort-Bau Zrt.
Location of the cameras and the areas or objects monitored:

A total of 31 cameras have been installed:

Indoor areas:

• 3 at the reception
• 1 opposite the lift
• 1 by the bowling alley
• 2 by the billiard table
• 1 in the fitness room
• 2 in the wellness area
• 3 in the lobby bar and wellness bar areas
• 4 in the restaurant
• 9 in the kitchen area
• 2 in the hotel corridors

Outdoor areas:

3 at the service entrances

The field of view of every camera is limited exclusively to common areas. No camera is aimed directly at monitoring the activities or behaviour of employees or guests. The cameras are operated for property protection and accident prevention, and they have been positioned and adjusted accordingly.

10. The controller carries out recorded video surveillance using the cameras.

11. Storage location, retention period and security measures: The controller stores the recordings at its registered office on the recording device’s hard drive, protected by a username and password.

12. The controller does not disclose the recordings, except in response to requests from competent authorities.

13. Rights of data subjects and legal remedies
The data subject may request information about the processing of their personal data and may request the rectification or, except where processing is mandatory, the deletion or withdrawal of their personal data. The data subject may also exercise their right to data portability and their right to object using the method indicated at the time of data collection or through the controller’s contact details provided above. At the request of the data subject, the information will be provided electronically without undue delay and no later than within 30 days. If the information cannot be provided within 30 days, the data subject will be notified within 30 days of the request, and the requested information will be provided within 2 months following that notification. Requests to exercise the rights listed below are handled free of charge.

Right to information:
Our company takes appropriate measures to provide data subjects with all information referred to in Articles 13 and 14 of the GDPR concerning the processing of personal data, as well as all notices under Articles 15–22 and 34, in a concise, transparent, intelligible and easily accessible form, using clear and plain language while maintaining legal precision.
The right to information may be exercised in writing through the contact details provided in Section 8. Upon request and after verification of the data subject’s identity, information may also be provided orally. We inform our clients that if our employees have doubts concerning the identity of the data subject, we may request additional information necessary to confirm the data subject’s identity.

Right of access:
The data subject has the right to obtain confirmation from the controller as to whether or not personal data concerning them are being processed. Where personal data are being processed, the data subject has the right to access the personal data and the following information.

Purposes of the processing;

• the categories of personal data concerned;
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries (outside the European Union) or international organisations;
• the envisaged period for which the personal data will be stored;
• the right to request rectification, erasure or restriction of processing and the right to object;
• the right to lodge a complaint with a supervisory authority;
• information on the source of the data; the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

In addition, where personal data are transferred to a third country or an international organisation, the data subject has the right to be informed of the appropriate safeguards relating to the transfer.

Right to rectification:
Under this right, any person may request the rectification of inaccurate personal data concerning them that are processed by our company and the completion of incomplete data.

Right to erasure:
The data subject has the right to request the erasure of personal data concerning them without undue delay where one of the following grounds applies:

a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

b) the data subject withdraws the consent on which the processing is based and there is no other legal ground for the processing;

c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing;

d) the personal data have been unlawfully processed;

e) the personal data must be erased to comply with a legal obligation under Union or Member State law applicable to the controller;

f) the personal data have been collected in relation to the offer of information society services.

Erasure may not be requested where processing is necessary for the following purposes:

a) for exercising the right of freedom of expression and information;

b) for compliance with a legal obligation requiring processing under Union or Member State law applicable to the controller, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

c) for reasons of public interest in the area of public health, or for archiving purposes, scientific or historical research purposes or statistical purposes in the public interest;

d) or for the establishment, exercise or defence of legal claims.

Right to restriction of processing:
At the request of the data subject, we restrict processing where the conditions set out in Article 18 of the GDPR apply, namely where:

a) the data subject contests the accuracy of the personal data, in which case the restriction applies for a period enabling the accuracy of the personal data to be verified;

b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

c) the controller no longer needs the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise or defence of legal claims; or

d) the data subject has objected to processing, in which case the restriction applies until it has been determined whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted, personal data may, with the exception of storage, be processed only with the data subject’s consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State. The data subject must be informed in advance before the restriction of processing is lifted.

Right to data portability:
The data subject has the right to receive the personal data concerning them that they have provided to the controller in a structured, commonly used and machine-readable format, and to transmit those data to another controller. Our company can fulfil such requests in Word or Excel format.

Right to object:
Where personal data are processed on the basis of legitimate interest, the data subject has the right to object at any time to the processing of personal data concerning them for that purpose. If the data subject objects to processing based on legitimate interest, the data may no longer be processed for that purpose.

Right to withdraw consent:
The data subject has the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Procedural rules:
The controller informs the data subject of the action taken on a request under Articles 15–22 of the GDPR without undue delay and in any event within one month of receipt of the request. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months. The controller informs the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.
Where the data subject submitted the request electronically, the information will be provided electronically unless the data subject requests otherwise.
If the controller does not take action on the data subject’s request, the controller informs the data subject without delay and no later than within one month of receipt of the request of the reasons for not taking action, and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
The controller communicates any rectification, erasure or restriction of processing to every recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller informs the data subject about those recipients upon request.

Compensation and damages for non-material harm:
Any person who has suffered material or non-material damage as a result of an infringement of the data protection regulation is entitled to receive compensation from the controller or processor for the damage suffered under this CCTV data processing notice. A processor is liable for damage caused by processing only where it has failed to comply with obligations under the law specifically directed to processors, or where it has acted outside or contrary to the controller’s lawful instructions. Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and are responsible for damage caused by the processing, each controller or processor is jointly and severally liable for the entire damage.
The controller or processor is exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.

Right to judicial remedy and data protection authority proceedings:
If the data subject’s rights are infringed, the data subject may bring proceedings against the controller before a court. The court will hear the case as a matter of priority.
A complaint may be lodged with the Hungarian National Authority for Data Protection and Freedom of Information.
Authority address: 1125 Budapest, Szilágyi Erzsébet fasor 22/C.; postal address: 1530 Budapest, Pf.: 5.
Phone: +36-1-391-1400, E-mail: ugyfelszolgalat@naih.hu