{"id":768,"date":"2026-07-07T09:52:24","date_gmt":"2026-07-07T09:52:24","guid":{"rendered":"https:\/\/newyorkpalota.hu\/?page_id=768"},"modified":"2026-08-19T07:50:15","modified_gmt":"2026-08-19T07:50:15","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/newyorkpalota.hu\/en\/adatvedelmi-szabalyzat\/","title":{"rendered":"Privacy Policy"},"content":{"rendered":"<div data-elementor-type=\"wp-page\" data-elementor-id=\"768\" class=\"elementor elementor-768\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a66b65b e-flex e-con-boxed e-con e-parent\" data-id=\"a66b65b\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;,&quot;shape_divider_bottom&quot;:&quot;triangle-asymmetrical&quot;,&quot;shape_divider_bottom_negative&quot;:&quot;yes&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-shape elementor-shape-bottom\" aria-hidden=\"true\" data-negative=\"true\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 1000 100\" preserveaspectratio=\"none\">\n\t<path class=\"elementor-shape-fill\" d=\"M737.9,94.7L0,0v100h1000V0L737.9,94.7z\"\/>\n<\/svg>\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-717705f e-con-full e-flex e-con e-child\" data-id=\"717705f\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-39b06b5 elementor-invisible elementor-widget elementor-widget-heading\" data-id=\"39b06b5\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;_animation&quot;:&quot;fadeInLeft&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Privacy Policy<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-3b48411 e-flex e-con-boxed e-con e-parent\" data-id=\"3b48411\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-b2303e8 elementor-widget elementor-widget-text-editor\" data-id=\"b2303e8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><style><span data-mce-type=\"bookmark\" style=\"display: inline-block; width: 0px; overflow: hidden; line-height: 0;\" class=\"mce_SELRES_start\">\ufeff<\/span><br \/>  \/* Asztali g\u00e9p, tablet \u00e9s mobil reszponz\u00edv t\u00e1bl\u00e1zat be\u00e1ll\u00edt\u00e1sok *\/<br \/>  table {<br \/>    width: 100% !important;<br \/>    max-width: 100% !important;<br \/>    border-collapse: collapse;<br \/>    table-layout: auto;<br \/>  }<br \/>  table td, table th {<br \/>    word-break: break-word;<br \/>  }<\/p>\n<p>  \/* Mobil n\u00e9zet speci\u00e1lis szab\u00e1lyai, hogy ne l\u00f3gjon ki semmi *\/<br \/>  @media screen and (max-width: 767px) {<br \/>    table {<br \/>      display: block !important;<br \/>      overflow-x: auto !important;<br \/>      -webkit-overflow-scrolling: touch;<br \/>    }<br \/>    table td, table th {<br \/>      max-width: 300px;<br \/>    }<br \/>  }<br \/><\/style><\/p><p style=\"text-align: center;\"><b>New York Palace Event Website<\/b><b><br \/><\/b> <b>https:\/\/www.newyorkpalota.hu\/<\/b><\/p><p style=\"text-align: center;\"><span style=\"font-weight: 400;\">Effective: August 1, 2026<\/span><\/p><p><span style=\"font-weight: 400;\">This privacy notice explains the purposes, legal basis, duration, and conditions under which the operator of the New York Palota events website processes the personal data of website visitors, those requesting quotes, event contacts, newsletter subscribers, and individuals who use the contact channels available on the website.<\/span><\/p><p><span style=\"font-weight: 400;\">This privacy notice covers the technical operation and security of the website, the receipt and processing of requests for quotes, the submission of quotes and event preparation, communication, newsletter distribution, the recording of cookie settings, and\u2014depending on the actual technical configurations\u2014data processing related to the use of analytics and marketing technologies.<\/span><\/p><h2><span style=\"font-weight: 400;\">1. Information about the Data Controller<\/span><\/h2><table><tbody><tr><td><b>Data<\/b><\/td><td><b>Contents<\/b><\/td><\/tr><tr><td><b>Full Name of the Data Controller<\/b><\/td><td><b>CER Event Planning and Catering Limited Liability Company<\/b><\/td><\/tr><tr><td><b>Abbreviated name<\/b><\/td><td><b>CER, Ltd.<\/b><\/td><\/tr><tr><td><b>Brand Name \/ Business Unit<\/b><\/td><td><b>New York Palace \u2013 Event Venue<\/b><\/td><\/tr><tr><td><b>Headquarters<\/b><\/td><td><b>1146 Budapest, Ajt\u00f3si D\u00fcrer sor 5, 1st floor, apt. 1.<\/b><\/td><\/tr><tr><td><b>Company Registration Number<\/b><\/td><td><b>01-09-983650<\/b><\/td><\/tr><tr><td><b>Tax ID Number<\/b><\/td><td><b>23907795-2-42<\/b><\/td><\/tr><tr><td><b>Representative<\/b><\/td><td><b>Jen\u0151 Magyary<\/b><\/td><\/tr><tr><td><b>Event Venue Address<\/b><\/td><td><span style=\"font-weight: 400;\">1073 Budapest, Erzs\u00e9bet Boulevard 9\u201311.<\/span><\/td><\/tr><tr><td><b>Website<\/b><\/td><td><span style=\"font-weight: 400;\">https:\/\/www.newyorkpalota.hu\/<\/span><\/td><\/tr><tr><td><b>General Contact Email<\/b><\/td><td><b>info@newyorkpalota.hu<\/b><\/td><\/tr><tr><td><b>Phone<\/b><\/td><td><b>+36 1 88 66 134<\/b><\/td><\/tr><\/tbody><\/table><h2><span style=\"font-weight: 400;\">2. Fundamental Principles of Data Processing<\/span><\/h2><p><span style=\"font-weight: 400;\">The Data Controller processes personal data in accordance with Regulation (EU) 2016\/679 of the European Parliament and of the Council (hereinafter: GDPR).<\/span><\/p><ul><li><span style=\"font-weight: 400;\">Personal data is processed lawfully, fairly, and in a manner that is transparent to the data subjects.<\/span><\/li><li><span style=\"font-weight: 400;\">The Data Controller processes data solely for specific, explicit, and lawful purposes, and only to the extent that is necessary and proportionate.<\/span><\/li><li><span style=\"font-weight: 400;\">The Data Controller shall take reasonable measures to ensure the accuracy and, where necessary, the timeliness of the data.<\/span><\/li><li><span style=\"font-weight: 400;\">The Data Controller retains the data only for as long as is necessary to achieve the purpose and to comply with legal obligations.<\/span><\/li><li><span style=\"font-weight: 400;\">The Data Controller protects the data from unauthorized access, alteration, disclosure, loss, or destruction through appropriate technical and organizational measures.<\/span><\/li><li><span style=\"font-weight: 400;\">The Data Controller documents data processing activities in accordance with the requirement of accountability.<\/span><\/li><\/ul><h4>\u00a0<\/h4><h2><span style=\"font-weight: 400;\">3. Specific Data Processing Activities<\/span><\/h2><h3>3.1. Technical Operation and IT Security of the Website<\/h3><table><tbody><tr><td><b>Data Processing Element<\/b><\/td><td><b>Contents<\/b><\/td><\/tr><tr><td><b>Purpose of Data Processing<\/b><\/td><td><span style=\"font-weight: 400;\">To ensure the secure and proper operation of the website; to detect and resolve errors; and to prevent, detect, log, and investigate cyberattacks and misuse.<\/span><\/td><\/tr><tr><td><b>Stakeholders<\/b><\/td><td><span style=\"font-weight: 400;\">Visitors to the website and users of online forms.<\/span><\/td><\/tr><tr><td><b>Data Processed<\/b><\/td><td><span style=\"font-weight: 400;\">IP address, date and time of visit, requested URL or resource, referring page, browser and device information, operating system, technical identifiers, error codes, server and security log data.<\/span><\/td><\/tr><tr><td><b>Legal Basis<\/b><\/td><td><span style=\"font-weight: 400;\">Article 6(1)(f) of the GDPR: The Data Controller\u2019s legitimate interest in operating the website, protecting the IT system and the personal data being processed, and preventing misuse.<\/span><\/td><\/tr><tr><td><b>Source of data<\/b><\/td><td><span style=\"font-weight: 400;\">The user\u2019s device and browser, as well as the systems that operate the website, web hosting, and security services.<\/span><\/td><\/tr><tr><td><b>Retention Period<\/b><\/td><td><span style=\"font-weight: 400;\">The general duration is up to 30 days; in the event of a security incident, the duration is limited to the time necessary to investigate the matter and assert legal claims.<\/span><\/td><\/tr><tr><td><b>Recipients \/ Data Processors<\/b><\/td><td><p><b>Web Hosting Provider: Sybell Informatikai Kft.<\/b><\/p><p><b>Developer: Marketing Astro Kft.<\/b><\/p><p><b>Operator\/Maintenance Provider: Eventrend Project Kft.; IT and Security Service Provider: Sybell Informatikai Kft.<\/b><\/p><\/td><\/tr><tr><td><b>Consequences of Data Reporting<\/b><\/td><td><span style=\"font-weight: 400;\">Technical data processing is an inherent part of using the website. Without the processing of this data, the secure and stable operation of the website cannot be guaranteed.<\/span><\/td><\/tr><\/tbody><\/table><h3>3.2. Contacting Us by Email or Phone<\/h3><table><tbody><tr><td><b>Data Processing Element<\/b><\/td><td><b>Contents<\/b><\/td><\/tr><tr><td><b>Purpose of Data Processing<\/b><\/td><td><span style=\"font-weight: 400;\">Receiving the inquiry, identifying the individual concerned, responding to the question or request, maintaining contact, preparing for any potential service or contract, and documenting the proceedings.<\/span><\/td><\/tr><tr><td><b>Stakeholders<\/b><\/td><td><span style=\"font-weight: 400;\">Individuals, sole proprietors, as well as legal entities and other organizations that contact the New York Palace, and their designated contacts who are natural persons.<\/span><\/td><\/tr><tr><td><b>Data Processed<\/b><\/td><td><span style=\"font-weight: 400;\">Name, company name\/organization name, job title or contact role (if applicable), email address, phone number, the subject and content of the inquiry, the date and time of the communication, and any additional data generated during the handling of the matter.<\/span><\/td><\/tr><tr><td><b>Legal Basis<\/b><\/td><td><span style=\"font-weight: 400;\">Article 6(1)(b) of the GDPR, if the processing is necessary for steps taken at the data subject\u2019s request prior to entering into a contract or for the performance of a contract. Contact person for a legal entity or other organization, as well as in the case of general, partner, or professional inquiries: Article 6(1)(f) of the GDPR\u2014the legitimate interests of the Data Controller and the inquiring organization in maintaining contact and conducting business.<\/span><\/td><\/tr><tr><td><b>Source of data<\/b><\/td><td><span style=\"font-weight: 400;\">Directly from the individual concerned, or\u2014in the case of an organizational contact person\u2014from the employer, client, or colleague who designated that person.<\/span><\/td><\/tr><tr><td><b>Retention Period<\/b><\/td><td><span style=\"font-weight: 400;\">S<\/span><span style=\"font-weight: 400;\">1 year from the date the matter is closed, provided no contract has been entered into; in the case of a contractual matter, 5 years from the date the contract terminates; in the case of a legal dispute, until the dispute is finally resolved.<\/span><\/td><\/tr><tr><td><b>Recipients \/ Data Processors<\/b><\/td><td><span style=\"font-weight: 400;\">Sales, event planning, finance, legal, and management staff with jurisdiction over the matter; and, if necessary, the Data Controller\u2019s contracted information technology and communications service providers.<\/span><\/td><\/tr><tr><td><b>Consequences of Data Reporting<\/b><\/td><td><span style=\"font-weight: 400;\">Contacting us is voluntary. If the information necessary to respond to your inquiry is missing, the Data Controller will be unable to respond or will only be able to do so to a limited extent.<\/span><\/td><\/tr><\/tbody><\/table><h3>3.3. Requesting a Quote for an Event Using the Website Form<\/h3><p><span style=\"font-weight: 400;\">Consent to data processing is not required to submit the request for proposal form. The legal basis for data processing is the pre-contractual process initiated by the contracting authority or, in the case of an organizational contact person, the legitimate interest of the parties in maintaining contact.<\/span><\/p><table><tbody><tr><td><span style=\"font-weight: 400;\">Data Processing Element<\/span><\/td><td><span style=\"font-weight: 400;\">Contents<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">Purpose of Data Processing<\/span><\/td><td><span style=\"font-weight: 400;\">Receiving and recording event requests; identifying the client and ensuring contact information is available; assessing the event\u2019s basic details; assessing capacity and feasibility; preparing a customized proposal; coordinating details of the proposal; preparing the contract; and documenting the sales process.<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">Stakeholders<\/span><\/td><td><span style=\"font-weight: 400;\">Private individuals requesting quotes, sole proprietors, as well as the natural person contacts of companies, institutions, and other organizations.<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">Data Processed<\/span><\/td><td><span style=\"font-weight: 400;\">Name, company name, email address, phone number, the content of the message and the request for a quote; as well as, during subsequent discussions, the planned date, type, number of attendees, venue and room requirements, technical and catering needs, budget, history of quotes and communications, the status of the quote, and technical details regarding the submission of the form.<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">Legal Basis<\/span><\/td><td><span style=\"font-weight: 400;\">Article 6(1)(b) of the GDPR, if the requesting party, as a natural person, is requesting a quote for their own event. In the case of a contact person for a legal entity or other organization, Article 6(1)(f) of the GDPR: the legitimate interest of the Data Controller and the requesting organization in establishing a business relationship, submitting a bid, and preparing a contract.<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">Source of data<\/span><\/td><td><span style=\"font-weight: 400;\">Directly from the person filling out the form; during further consultations, from the requesting party and the contacts designated by the requesting party.<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">Retention Period<\/span><\/td><td><span style=\"font-weight: 400;\">In the case of a rejected offer or failed negotiations, 1 year from the date of the last substantive contact; in the case of a concluded contract, 5 years from the date of termination of the contract; in the case of accounting documents, 8 years.<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">Recipients \/ Data Processors<\/span><\/td><td><span style=\"font-weight: 400;\">DYNEX Limited Liability Company (Dynex Kft.; registered office: 1238 Budapest, H\u0151s\u00f6k tere 37; company registration number: 01-09-439155; tax ID: 32722510-2-43) as the data processor.<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">Consequences of Data Reporting<\/span><\/td><td><span style=\"font-weight: 400;\">Without the information marked as required, the Data Controller will not be able to process the request for a quote or contact the requester. You may omit the optional information.<\/span><\/td><\/tr><\/tbody><\/table><h3>3.4. Managing Requests for Proposals in the Dynex CRM System<\/h3><table><tbody><tr><td><b>Data Processing Element<\/b><\/td><td><b>Contents<\/b><\/td><\/tr><tr><td><b>Purpose of Data Processing<\/b><\/td><td><span style=\"font-weight: 400;\">Centralized tracking of requests for proposals and inquiries; monitoring the sales process; managing tasks and communication history; documenting the status of proposals; and supporting service-related communication related to requests for proposals.<\/span><\/td><\/tr><tr><td><b>Stakeholders<\/b><\/td><td><span style=\"font-weight: 400;\">Individuals who request quotes on the website and the natural persons serving as contacts for the events.<\/span><\/td><\/tr><tr><td><b>Data Processed<\/b><\/td><td><span style=\"font-weight: 400;\">Data sets stored in Dynex, including, in particular, contact information, prospect profiles, request-for-quote and event data, statuses, internal notes, tasks, email\/SMS communications, consent data, activity data, and delivery data.<\/span><\/td><\/tr><tr><td><b>Legal Basis<\/b><\/td><td><span style=\"font-weight: 400;\">In accordance with the legal basis of the underlying request for proposal or contract, Article 6(1)(b) or (f) of the GDPR.<\/span><\/td><\/tr><tr><td><b>Source of data<\/b><\/td><td><span style=\"font-weight: 400;\">From the form on the website, from communications with the requesting party, and from data recorded by the Data Controller\u2019s staff during the processing of the request.<\/span><\/td><\/tr><tr><td><b>Retention Period<\/b><\/td><td><span style=\"font-weight: 400;\">In the case of a rejected offer or failed negotiations, 1 year from the date of the last substantive contact; in the case of a concluded contract, 5 years from the date of termination of the contract; in the case of accounting documents, 8 years.<\/span><\/td><\/tr><tr><td><b>Recipients \/ Data Processors<\/b><\/td><td><span style=\"font-weight: 400;\">DYNEX Limited Liability Company (Dynex Kft.; registered office: 1238 Budapest, H\u0151s\u00f6k tere 37; company registration number: 01-09-439155; tax ID: 32722510-2-43) as the data processor.<\/span><\/td><\/tr><tr><td><b>Consequences of Data Reporting<\/b><\/td><td><span style=\"font-weight: 400;\">Recording the request for proposal in the CRM is an internal technical procedure for handling the request; it does not require any separate data reporting to the requesting party.<\/span><\/td><\/tr><\/tbody><\/table><h3>3.5. Contract Execution and Event Planning Following the Submission of Bids<\/h3><table><tbody><tr><td><b>Data Processing Element<\/b><\/td><td><b>Contents<\/b><\/td><\/tr><tr><td><b>Purpose of Data Processing<\/b><\/td><td><span style=\"font-weight: 400;\">Entering into and fulfilling event planning or venue rental contracts; maintaining communication; handling the professional, technical, and catering preparations for the event; documenting orders and changes; invoicing; handling complaints; and managing legal claims.<\/span><\/td><\/tr><tr><td><b>Stakeholders<\/b><\/td><td><span style=\"font-weight: 400;\">The customer is a natural person, a sole proprietor, a legal entity, or an organization; the natural persons acting as representatives or points of contact for such entities; and identifiable individuals involved in organizing the event.<\/span><\/td><\/tr><tr><td><b>Data Processed<\/b><\/td><td><span style=\"font-weight: 400;\">Request for Proposal (RFP) details; contract and billing information; names, job titles, and contact information of points of contact; event details; orders and modifications; performance, financial, complaint, and legal dispute data; and, if necessary, other information essential for organizing the event.<\/span><\/td><\/tr><tr><td><b>Legal Basis<\/b><\/td><td><span style=\"font-weight: 400;\">Article 6(1)(b) of the GDPR in the case of a natural person who is a contracting party; Article 6(1)(f) of the GDPR in the case of contact persons at the contracting organization; Article 6(1)(c) of the GDPR when fulfilling accounting, tax, and consumer protection obligations; Article 6(1)(f) of the GDPR for the purpose of asserting, exercising, or defending legal claims.<\/span><\/td><\/tr><tr><td><b>Source of data<\/b><\/td><td><span style=\"font-weight: 400;\">From the data subject, the client, the representative of the contracting organization, and its points of contact, as well as from documents generated during the performance of the contract.<\/span><\/td><\/tr><tr><td><b>Retention Period<\/b><\/td><td><span style=\"font-weight: 400;\">As a general rule, contracts and related documents must be retained for 5 years from the termination or fulfillment of the contract; accounting documents and supporting documents must be retained for 8 years; complaints for the period specified by applicable consumer protection regulations; and in the event of a legal dispute, until the matter is finally resolved.<\/span><\/td><\/tr><tr><td><b>Recipients \/ Data Processors<\/b><\/td><td><span style=\"font-weight: 400;\">A<\/span><span style=\"font-weight: 400;\"> subcontractors, technical service providers, catering providers, security providers, and other service providers who are actually involved in carrying out the event; in each case, only to the extent necessary for their tasks, with their legal roles precisely defined<\/span><\/td><\/tr><tr><td><b>Consequences of Data Reporting<\/b><\/td><td><span style=\"font-weight: 400;\">Without the information required to enter into and fulfill the contract, the Data Controller cannot finalize an offer, enter into a contract, or carry out the event.<\/span><\/td><\/tr><\/tbody><\/table><h3>3.6. Newsletters and Electronic Direct Marketing<\/h3><p><span style=\"font-weight: 400;\">Subscribing to the newsletter is separate from requesting a quote and from using any other services. Subscription requires separate, voluntary, specific, and unambiguous consent.<\/span><\/p><table><tbody><tr><td><b>Data Processing Element<\/b><\/td><td><b>Contents<\/b><\/td><\/tr><tr><td><b>Purpose of Data Processing<\/b><\/td><td><span style=\"font-weight: 400;\">Sending newsletters, news, offers, and promotional messages related to event venues, catering, and the Data Controller\u2019s services; documenting consent and unsubscriptions; measuring the effectiveness of campaigns.<\/span><\/td><\/tr><tr><td><b>Stakeholders<\/b><\/td><td><span style=\"font-weight: 400;\">People who have voluntarily subscribed to the newsletter.<\/span><\/td><\/tr><tr><td><b>Data Processed<\/b><\/td><td><span style=\"font-weight: 400;\">Email address; name; date, source, and version of the consent; IP address and technical log; date of unsubscription<\/span><\/td><\/tr><tr><td><b>Legal Basis<\/b><\/td><td><span style=\"font-weight: 400;\">Consent pursuant to Article 6(1)(a) of the GDPR. Consent may be withdrawn at any time without providing a reason.<\/span><\/td><\/tr><tr><td><b>Source of data<\/b><\/td><td><span style=\"font-weight: 400;\">Directly from the subscriber and from the technical logs of the newsletter distribution system.<\/span><\/td><\/tr><tr><td><b>Retention Period<\/b><\/td><td><span style=\"font-weight: 400;\">Until consent is withdrawn or the newsletter service is discontinued.<\/span><\/td><\/tr><tr><td><b>Recipients \/ Data Processors<\/b><\/td><td><span style=\"font-weight: 400;\">DYNEX Limited Liability Company (Dynex Kft.; registered office: 1238 Budapest, H\u0151s\u00f6k tere 37; company registration number: 01-09-439155; tax ID number: 32722510-2-43) as an email delivery service provider<\/span><\/td><\/tr><tr><td><b>Consequences of Data Reporting<\/b><\/td><td><span style=\"font-weight: 400;\">Subscription is voluntary. Refusing or withdrawing consent will not affect your ability to request a quote or use any other services.<\/span><\/td><\/tr><\/tbody><\/table><h3>3.7. Cookie Settings, Consents, and Web Analytics<\/h3><table><tbody><tr><td><b>Data Processing Element<\/b><\/td><td><b>Contents<\/b><\/td><\/tr><tr><td><b>Purpose of Data Processing<\/b><\/td><td><span style=\"font-weight: 400;\">To record and apply the user's cookie settings, and to provide evidence of consent or refusal; in the event of consent, to collect visitor statistics, measure performance, and conduct marketing-related tracking.<\/span><\/td><\/tr><tr><td><b>Stakeholders<\/b><\/td><td><span style=\"font-weight: 400;\">Visitors to the website.<\/span><\/td><\/tr><tr><td><b>Data Processed<\/b><\/td><td><span style=\"font-weight: 400;\">Consent ID, selected cookie categories, date and version of consent or opt-out, browser and device data; if consent is granted, online identifiers, event data, and usage data collected by the analytics or marketing system in use.<\/span><\/td><\/tr><tr><td><b>Legal Basis<\/b><\/td><td><span style=\"font-weight: 400;\">In the case of strictly necessary technologies and the recording of consent choices, Article 6(1)(f) of the GDPR: legitimate interests related to the operation of the website, respect for user choices, and accountability. For analytics, convenience, and marketing technologies: prior consent pursuant to Article 6(1)(a) of the GDPR.<\/span><\/td><\/tr><tr><td><b>Source of data<\/b><\/td><td><span style=\"font-weight: 400;\">The user's browser, device, and cookie management platform.<\/span><\/td><\/tr><tr><td><b>Retention Period<\/b><\/td><td><span style=\"font-weight: 400;\">The actual duration of the consent log in the cookie management platform and of the specific cookies. The exact details are provided in the cookie management panel, specifically in the information regarding cookies.<\/span><\/td><\/tr><tr><td><b>Recipients \/ Data Processors<\/b><\/td><td><span style=\"font-weight: 400;\">The cookie consent management platform, Google Analytics\/Google Tag Manager, Google Ads, Meta Pixel, embedded maps, videos, social media, spam protection, or other technologies\u2014based solely on the actual cookie scan and tag list.<\/span><\/td><\/tr><tr><td><b>Consequences of Data Reporting<\/b><\/td><td><span style=\"font-weight: 400;\">Rejecting non-essential cookies does not restrict access to the website\u2019s core content. Some optional embedded features become available only after you provide the appropriate consent.<\/span><\/td><\/tr><tr><td><b>Further Information<\/b><\/td><td><span style=\"font-weight: 400;\">The detailed name, provider, purpose, category, and duration of each cookie are listed in a separate cookie management panel, in the cookie policy. You may modify or withdraw your consent at any time via the \u201eCookie Settings\u201d page available on the website.<\/span><\/td><\/tr><\/tbody><\/table><h3>3.8. Social Media Pages and External Links<\/h3><table><tbody><tr><td><b>Data Processing Element<\/b><\/td><td><b>Contents<\/b><\/td><\/tr><tr><td><b>Purpose of Data Processing<\/b><\/td><td><span style=\"font-weight: 400;\">Engaging with the community on social media platforms, responding to questions and messages, promoting the services of the New York Palace, and\u2014where applicable\u2014reviewing aggregate page statistics.<\/span><\/td><\/tr><tr><td><b>Stakeholders<\/b><\/td><td><span style=\"font-weight: 400;\">People who visit, follow, send messages to, comment on, or otherwise interact with the New York Palota\u2019s social media pages.<\/span><\/td><\/tr><tr><td><b>Data Processed<\/b><\/td><td><span style=\"font-weight: 400;\">Profile names and profile information displayed publicly on the platform; messages, comments, and reactions; the content and timing of communications; and aggregated statistical data provided by the platform.<\/span><\/td><\/tr><tr><td><b>Legal Basis<\/b><\/td><td><span style=\"font-weight: 400;\">Depending on the purpose of the request, Article 6(1)(b) or (f) of the GDPR; legitimate interest related to community communication and customer relations. The platform provider acts as a sole data controller with respect to the operation of its own platform, and as a joint data controller with respect to certain site statistics in conjunction with the relevant platform<\/span><\/td><\/tr><tr><td><b>Source of data<\/b><\/td><td><span style=\"font-weight: 400;\">Directly from the person concerned and the social media platform.<\/span><\/td><\/tr><tr><td><b>Retention Period<\/b><\/td><td><span style=\"font-weight: 400;\">According to internal message management practices, data is retained for up to 1 year after the case is closed, or up to 5 years in the event of a legal claim. The retention of data appearing on the platform is governed by the platform\u2019s own rules and the user\u2019s settings.<\/span><\/td><\/tr><tr><td><b>Recipients \/ Data Processors<\/b><\/td><td><span style=\"font-weight: 400;\">Social media platforms and representatives involved in managing social media.<\/span><\/td><\/tr><tr><td><b>Consequences of Data Reporting<\/b><\/td><td><span style=\"font-weight: 400;\">The use of social media is optional. The website may not transmit any data to the platform before you click on a simple external link posted on the website. Embedded social media content can only be loaded after the appropriate cookie settings have been configured.<\/span><\/td><\/tr><\/tbody><\/table><h3>3.9. Handling Complaints, Incidents, and Legal Claims<\/h3><table><tbody><tr><td><b>Data Processing Element<\/b><\/td><td><b>Contents<\/b><\/td><\/tr><tr><td><b>Purpose of Data Processing<\/b><\/td><td><span style=\"font-weight: 400;\">Investigating complaints, quality-related issues, and extraordinary events; responding to them; complying with legal obligations; and asserting, enforcing, and defending legal claims.<\/span><\/td><\/tr><tr><td><b>Stakeholders<\/b><\/td><td><span style=\"font-weight: 400;\">Persons filing complaints or claims, relevant contacts, witnesses, and other natural persons involved in the matter.<\/span><\/td><\/tr><tr><td><b>Data Processed<\/b><\/td><td><span style=\"font-weight: 400;\">Name, contact information, address\u2014if required by law or for administrative purposes\u2014a description of the complaint or incident, its date and location, evidence, related communications and actions taken, as well as any additional information necessary to resolve the matter.<\/span><\/td><\/tr><tr><td><b>Legal Basis<\/b><\/td><td><span style=\"font-weight: 400;\">Article 6(1)(c) of the GDPR: to comply with consumer protection and other legal obligations; Article 6(1)(f) of the GDPR: to assert and defend the legal claims of the Data Controller or a third party.<\/span><\/td><\/tr><tr><td><b>Source of data<\/b><\/td><td><span style=\"font-weight: 400;\">From the person concerned, the client, witnesses, those involved, documents generated in connection with the case, and\u2014as specified in a separate notice\u2014from the on-site security systems.<\/span><\/td><\/tr><tr><td><b>Retention Period<\/b><\/td><td><span style=\"font-weight: 400;\">Complaints and written responses are retained in accordance with the applicable consumer protection retention period; data required for other legal claims are generally retained for 5 years, or, in the case of an ongoing matter, until it is finally resolved.<\/span><\/td><\/tr><tr><td><b>Recipients \/ Data Processors<\/b><\/td><td><span style=\"font-weight: 400;\">Legal and data protection advisors with jurisdiction over the matter, the insurance company, the regulatory authority, the court, and service providers whose involvement is necessary for the resolution of the matter.<\/span><\/td><\/tr><tr><td><b>Consequences of Data Reporting<\/b><\/td><td><span style=\"font-weight: 400;\">In the absence of the information necessary to investigate the complaint or claim, the matter cannot be investigated, or can only be investigated to a limited extent.<\/span><\/td><\/tr><\/tbody><\/table><h2>4. Data Processors, Recipients, and Access Within the Corporate Group<\/h2><p><span style=\"font-weight: 400;\">The Data Controller will disclose personal data only to recipients whose access to the data is necessary to fulfill the specific purpose and who have an appropriate legal basis for such access. Data processors may act solely in accordance with the Data Controller\u2019s documented instructions and under the terms set forth in a contract pursuant to Article 28 of the GDPR.<\/span><\/p><table><tbody><tr><td><b>Recipient \/ Service Provider Category<\/b><\/td><td><b>Role and Responsibilities<\/b><\/td><\/tr><tr><td><b>CRM and Database Provider<\/b><\/td><td><span style=\"font-weight: 400;\">Dynex Kft., 1238 Budapest, H\u0151s\u00f6k tere 37; company registration number: 01-09-439155; tax ID number: 32722510-2-43. Responsibilities: receiving\/storing requests for proposals, CRM, newsletters, automation, communication<\/span><\/td><\/tr><tr><td><b>Web Hosting Provider<\/b><\/td><td>Sybell Informatika Kft., 34 Tomori Street, 2nd Floor, 1138 Budapest<\/td><\/tr><tr><td><b>Website Developer and Maintenance Specialist<\/b><\/td><td><b>Sybell, Marketing Astro, Ltd. <\/b><\/td><\/tr><tr><td><b>Email and Office System<\/b><\/td><td><b>Email: BlazeArts Kft. <\/b><\/td><\/tr><tr><td><b>Cookie Management Platform<\/b><\/td><td><p><b>CookieYes Limited (CMP name: CookieYes)<\/b><\/p><p><b>The Consent Log (Proof of Consent) is available in your CookieYes account under the \"Consent Log\" menu item and can be exported from there (in CSV or PDF format).<\/b><\/p><p><b>CookieYes acts as a data processor and records consent information (pseudonymized IP address, country, consent status, timestamp, Consent ID).<\/b><\/p><\/td><\/tr><tr><td><b>Analytics and Marketing Service Providers<\/b><\/td><td><p><b>Google Analytics \/ Google Tag Manager \/ Google Ads (Google Ireland Limited \/ Google LLC)<\/b><\/p><p><b>Meta Pixel (Meta Platforms Ireland Limited)<\/b><\/p><\/td><\/tr><tr><td><b>Spam and Abuse Prevention<\/b><\/td><td><b>\u2013<\/b><\/td><\/tr><tr><td><b>Professional Advisors and Government Agencies<\/b><\/td><td><span style=\"font-weight: 400;\">Legal, accounting, auditing, data protection, and IT consultants, to the extent necessary for the performance of their duties; authorities and courts acting in accordance with the law.<\/span><\/td><\/tr><\/tbody><\/table><h4>\u00a0<\/h4><h2>5. Data Transfers Outside the European Economic Area<\/h2><p><span style=\"font-weight: 400;\">The Data Controller primarily processes and has personal data processed within the European Economic Area. If a service provider or subprocessor processes data outside the EEA, the transfer of data may only take place under safeguards in accordance with Chapter V of the GDPR, including, in particular, an adequacy decision, valid participation in the EU-U.S. data protection framework, standard contractual clauses, and, where necessary, additional safeguards.<\/span><\/p><h4>\u00a0<\/h4><h2>6. Automated Decision-Making and Profiling<\/h2><p><span style=\"font-weight: 400;\">The Data Controller does not make any decisions regarding the acceptance of a request for a quote, the content of a quote, or the conclusion of a contract that are based solely on automated processing and that have legal effects on the data subject or similarly significantly affect the data subject.<\/span><\/p><h4>\u00a0<\/h4><h2>7. Data Security<\/h2><p><span style=\"font-weight: 400;\">The Data Controller implements technical and organizational measures commensurate with the risks. These include, in particular, access control, individual user access rights, strong authentication, logging, backups, encrypted data transmission, regular review of access rights, employee confidentiality obligations, contractual oversight of data processors, incident management, and the timely deletion of data.<\/span><\/p><p><span style=\"font-weight: 400;\">Only those individuals who need access to requests for proposals and CRM data in order to perform their job duties may access such information. When access is no longer required, access rights must be revoked immediately.<\/span><\/p><h4>\u00a0<\/h4><h2>8. Rights of Data Subjects<\/h2><p><span style=\"font-weight: 400;\">Under the terms of the GDPR, the data subject may exercise the following rights:<\/span><\/p><p><b>Right of access: <\/b><span style=\"font-weight: 400;\">You may request information regarding whether the Data Controller is processing your personal data, and you may request a copy of the data being processed.<\/span><\/p><p><b>Right to Correction: <\/b><span style=\"font-weight: 400;\">You may request that inaccurate information be corrected and that missing information be provided.<\/span><\/p><p><b>Right to erasure: <\/b><span style=\"font-weight: 400;\">You may request that your data be deleted if the conditions set forth in the GDPR are met.<\/span><\/p><p><b>Restriction of data processing: <\/b><span style=\"font-weight: 400;\">You may request that the processing of your data be restricted, for example, if you dispute the accuracy of the data or due to legal claims.<\/span><\/p><p><b>Data Portability: <\/b><span style=\"font-weight: 400;\">In the case of automated data processing based on consent or a contract, you may request that the data you have provided be provided to you or transferred to you in a machine-readable format.<\/span><\/p><p><b>Right to Protest: <\/b><span style=\"font-weight: 400;\">You may object to data processing based on legitimate interests for reasons related to your particular situation. You may object to direct marketing at any time, without having to provide a reason.<\/span><\/p><p><b>Withdrawal of Consent: <\/b><span style=\"font-weight: 400;\">Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of previous data processing.<\/span><\/p><p><b>Rights related to automated decision-making: <\/b><span style=\"font-weight: 400;\">Subject to the applicable conditions, you may request human intervention, explain your position, and challenge the decision.<\/span><\/p><h4>\u00a0<\/h4><h2>9. Exercising Rights and Handling Requests<\/h2><p><span style=\"font-weight: 400;\">The data subject may submit their request to the contact address specified in Section 1. As a general rule, the Data Controller will respond to the request without undue delay, but no later than one month after receipt. This deadline may be extended by an additional two months, taking into account the complexity of the request and the number of requests received; the Data Controller will provide notice of any such extension.<\/span><\/p><p><span style=\"font-weight: 400;\">Before complying with a request, the Data Controller may request a reasonable verification of the data subject\u2019s identity and eligibility. As a general rule, requests are processed free of charge. In the case of manifestly unfounded or particularly repetitive or excessive requests, the Data Controller may charge a reasonable fee or refuse to comply with the request in accordance with the provisions of the GDPR.<\/span><\/p><h4>\u00a0<\/h4><h2>10. Legal Remedies<\/h2><p><span style=\"font-weight: 400;\">If the data subject believes that the processing of their personal data violates their right to data protection, they may file a complaint with the National Authority for Data Protection and Freedom of Information:<\/span><\/p><table><tbody><tr><td><b>Data<\/b><\/td><td><b>Contents<\/b><\/td><\/tr><tr><td><b>Name of the Authority<\/b><\/td><td><span style=\"font-weight: 400;\">National Authority for Data Protection and Freedom of Information<\/span><\/td><\/tr><tr><td><b>Title<\/b><\/td><td><span style=\"font-weight: 400;\">1055 Budapest, 9\u201311 Falk Miksa Street.<\/span><\/td><\/tr><tr><td><b>Mailing Address<\/b><\/td><td><span style=\"font-weight: 400;\">1363 Budapest, P.O. Box 9.<\/span><\/td><\/tr><tr><td><b>Email<\/b><\/td><td><span style=\"font-weight: 400;\">ugyfelszolgalat@naih.hu<\/span><\/td><\/tr><tr><td><b>Phone<\/b><\/td><td><span style=\"font-weight: 400;\">+36 (1) 391-1400<\/span><\/td><\/tr><tr><td><b>Website<\/b><\/td><td><span style=\"font-weight: 400;\">https:\/\/www.naih.hu\/<\/span><\/td><\/tr><\/tbody><\/table><p><span style=\"font-weight: 400;\">You may also bring the matter before the relevant court. You may file the lawsuit\u2014at your discretion\u2014with the court having jurisdiction over the Data Controller\u2019s registered office or over your place of residence or place of stay.<\/span><\/p><h4>\u00a0<\/h4><h2>11. Amendments to the Prospectus and Its Effective Date<\/h2><p><span style=\"font-weight: 400;\">The Data Controller may amend this privacy notice, particularly in the event of changes to the website\u2019s features, data processing procedures, service providers, or the legal framework. The currently effective version is available on the website. The Data Controller will provide separate notice in an appropriate manner regarding any changes that substantially affect the rights of data subjects or the terms of data processing.<\/span><\/p><p><b>Effective Date: August 1, 2026<\/b><\/p><p><b>Version Number: 1.0<\/b><\/p><h4>\u00a0<\/h4>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>New York Palota rendezv\u00e9nyes weboldala https:\/\/www.newyorkpalota.hu\/ Hat\u00e1lyos: 2026.08.01 Jelen t\u00e1j\u00e9koztat\u00f3 bemutatja, hogy a New York Palota rendezv\u00e9nyes weboldal\u00e1nak \u00fczemeltet\u0151je milyen c\u00e9lb\u00f3l, milyen jogalapon, mennyi ideig \u00e9s milyen felt\u00e9telekkel kezeli a weboldal l\u00e1togat\u00f3inak, az aj\u00e1nlatk\u00e9r\u0151knek, a rendezv\u00e9nyek kapcsolattart\u00f3inak, a h\u00edrlev\u00e9lre feliratkoz\u00f3knak, valamint a weboldalon el\u00e9rhet\u0151 kapcsolatfelv\u00e9teli csatorn\u00e1kat haszn\u00e1l\u00f3 szem\u00e9lyeknek a szem\u00e9lyes adatait. A t\u00e1j\u00e9koztat\u00f3 kiterjed a [&hellip;]<\/p>\n","protected":false},"author":6,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-768","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/newyorkpalota.hu\/en\/wp-json\/wp\/v2\/pages\/768","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newyorkpalota.hu\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/newyorkpalota.hu\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/newyorkpalota.hu\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/newyorkpalota.hu\/en\/wp-json\/wp\/v2\/comments?post=768"}],"version-history":[{"count":32,"href":"https:\/\/newyorkpalota.hu\/en\/wp-json\/wp\/v2\/pages\/768\/revisions"}],"predecessor-version":[{"id":4634,"href":"https:\/\/newyorkpalota.hu\/en\/wp-json\/wp\/v2\/pages\/768\/revisions\/4634"}],"wp:attachment":[{"href":"https:\/\/newyorkpalota.hu\/en\/wp-json\/wp\/v2\/media?parent=768"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}