{"id":50481,"date":"2026-11-09T19:35:46","date_gmt":"2026-11-09T19:35:46","guid":{"rendered":"https:\/\/dunarama.hu\/privacy-policy\/"},"modified":"2026-11-10T08:34:19","modified_gmt":"2026-11-10T08:34:19","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/dunarama.hu\/en\/privacy-policy\/","title":{"rendered":"Privacy Policy"},"content":{"rendered":"<style>.dn-legal{max-width:860px;margin:0 auto;padding:24px 16px;line-height:1.6}.dn-legal table{width:100%;border-collapse:collapse;margin:12px 0 20px}.dn-legal th,.dn-legal td{border:1px solid #d5dbe3;padding:8px 10px;text-align:left;vertical-align:top}.dn-legal th{background:#013064;color:#fff}.dn-legal h2{color:#013064;margin-top:32px}<\/style>\n<div class=\"dn-legal\">\n<p><em>Effective from 9 November 2026. This is an English translation; in case of any discrepancy, the <a href=\"https:\/\/dunarama.hu\/en\/privacy-policy\/\">Hungarian version<\/a> prevails.<\/em><\/p>\n<h2>1. Controller and legal background<\/h2>\n<p>1.1. This notice explains how Dunarama processes the personal data of its guests, customers and website visitors.<\/p>\n<table>\n<thead>\n<tr>\n<th>Item<\/th>\n<th>Details<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Controller<\/td>\n<td>Duna Port Szolg\u00e1ltat\u00f3, Ipari \u00e9s Kereskedelmi Korl\u00e1tolt Felel\u0151ss\u00e9g\u0171 T\u00e1rsas\u00e1g (Duna Port Kft.)<\/td>\n<\/tr>\n<tr>\n<td>Registered office<\/td>\n<td>1039 Budapest, Kir\u00e1lyok \u00fatja 195\u2013203. A. \u00e9p. fsz. 4., Hungary<\/td>\n<\/tr>\n<tr>\n<td>Company registration number<\/td>\n<td>01-09-898870<\/td>\n<\/tr>\n<tr>\n<td>Tax number<\/td>\n<td>12794087-2-41<\/td>\n<\/tr>\n<tr>\n<td>Data protection contact<\/td>\n<td>info@dunarama.hu, +36 70 9422 613<\/td>\n<\/tr>\n<tr>\n<td>Website<\/td>\n<td>dunarama.hu<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>1.2. The controller is not required to appoint a data protection officer, as its activities do not involve regular and systematic monitoring of data subjects on a large scale or large-scale processing of special categories of data (GDPR Article 37).<\/p>\n<p>1.3. Main applicable laws:<\/p>\n<ul>\n<li>Regulation (EU) 2016\/679 of the European Parliament and of the Council (&#8220;GDPR&#8221;);<\/li>\n<li>Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (&#8220;Infotv.&#8221;);<\/li>\n<li>Act V of 2013 on the Civil Code;<\/li>\n<li>Act CVIII of 2001 on Electronic Commerce Services;<\/li>\n<li>Act C of 2000 on Accounting and Act CXXVII of 2007 on Value Added Tax;<\/li>\n<li>Act CLV of 1997 on Consumer Protection;<\/li>\n<li>Act XLVIII of 2008 on Commercial Advertising;<\/li>\n<li>Act C of 2003 on Electronic Communications (cookies, Section 155 (4)).<\/li>\n<\/ul>\n<h2>2. Processing by purpose<\/h2>\n<p>The controller asks only for data needed for the purpose and keeps it only for the stated period. The controller does not ask for the names of the guests on the cruise, only the Customer&#8217;s.<\/p>\n<table>\n<thead>\n<tr>\n<th>Purpose<\/th>\n<th>Data<\/th>\n<th>Legal basis<\/th>\n<th>Retention<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Booking, performance of the contract<\/td>\n<td>name, e-mail, phone, date, time, programme, number of guests, notes (e.g. occasion, catering, allergens)<\/td>\n<td>GDPR Art. 6 (1) b) \u2013 contract; for allergens, the Customer&#8217;s explicit consent, Art. 9 (2) a)<\/td>\n<td>5 years after the cruise (general limitation period, Civil Code 6:22); allergen data is deleted after the cruise<\/td>\n<\/tr>\n<tr>\n<td>Payment of deposit and fee<\/td>\n<td>name, amount, transaction ID, time and status of payment (Dunarama does not see card data)<\/td>\n<td>GDPR Art. 6 (1) b) \u2013 contract<\/td>\n<td>8 years (Accounting Act, Section 169)<\/td>\n<\/tr>\n<tr>\n<td>Invoicing<\/td>\n<td>name or company name, address, tax number (companies), amount<\/td>\n<td>GDPR Art. 6 (1) c) \u2013 legal obligation (VAT Act Section 169, Accounting Act Section 169)<\/td>\n<td>8 years<\/td>\n<\/tr>\n<tr>\n<td>Enquiries, requests for quotes (e-mail, phone, form)<\/td>\n<td>name, e-mail, phone, content of the message<\/td>\n<td>GDPR Art. 6 (1) b) \u2013 pre-contractual steps; otherwise f) \u2013 legitimate interest (answering enquiries)<\/td>\n<td>1 year after the enquiry is closed; if a contract is concluded, as for bookings<\/td>\n<\/tr>\n<tr>\n<td>Complaint handling<\/td>\n<td>name, contact details, content of complaint, record, reply<\/td>\n<td>GDPR Art. 6 (1) c) \u2013 legal obligation (Consumer Protection Act Section 17\/A)<\/td>\n<td>3 years<\/td>\n<\/tr>\n<tr>\n<td>Damage and accident handling, insurance claims<\/td>\n<td>name, contact details, description of the event, health data where necessary<\/td>\n<td>GDPR Art. 6 (1) f) \u2013 legitimate interest (enforcing claims); for health data Art. 9 (2) f)<\/td>\n<td>5 years after the case is closed<\/td>\n<\/tr>\n<tr>\n<td>Newsletter, offers by e-mail (only with separate subscription)<\/td>\n<td>name, e-mail<\/td>\n<td>GDPR Art. 6 (1) a) \u2013 consent<\/td>\n<td>until consent is withdrawn<\/td>\n<\/tr>\n<tr>\n<td>Website operation and security<\/td>\n<td>IP address, browser data, log files<\/td>\n<td>GDPR Art. 6 (1) f) \u2013 legitimate interest (secure operation, blocking attacks)<\/td>\n<td>up to 30 days<\/td>\n<\/tr>\n<tr>\n<td>Statistics and advertising (cookies)<\/td>\n<td>see section 4<\/td>\n<td>GDPR Art. 6 (1) a) \u2013 consent<\/td>\n<td>see section 4<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>2.1. If the Customer provides data of others (their guests), they must inform them of this notice.<\/p>\n<p>2.2. The controller does not carry out automated decision-making or profiling with legal effects.<\/p>\n<p>2.3. The controller does not operate cameras on the boat or at the pier.<\/p>\n<h2>3. Processors and recipients<\/h2>\n<p>The controller uses the following service providers. Processors may process data only on the controller&#8217;s instructions, under a written contract (GDPR Article 28). The controller does not sell personal data.<\/p>\n<table>\n<thead>\n<tr>\n<th>Provider<\/th>\n<th>Role<\/th>\n<th>Task<\/th>\n<th>Location<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Hostinger International Ltd.<\/td>\n<td>processor<\/td>\n<td>hosting, website operation<\/td>\n<td>61 Lordou Vironos Street, 6023 Larnaca, Cyprus (EU)<\/td>\n<\/tr>\n<tr>\n<td>Cal.com, Inc.<\/td>\n<td>processor<\/td>\n<td>online booking system, confirmation e-mails<\/td>\n<td>2261 Market Street #4382, San Francisco, CA 94114, USA<\/td>\n<\/tr>\n<tr>\n<td>Teya Iceland hf.<\/td>\n<td>independent controller for card data<\/td>\n<td>online and on-site card payments, payment link<\/td>\n<td>Katr\u00ednart\u00fan 4, 105 Reykjav\u00edk, Iceland (EEA)<\/td>\n<\/tr>\n<tr>\n<td>V\u00edgh Anik\u00f3<\/td>\n<td>processor<\/td>\n<td>accounting, invoice records<\/td>\n<td>Hungary<\/td>\n<\/tr>\n<tr>\n<td>Billingo Technologies Zrt.<\/td>\n<td>processor<\/td>\n<td>invoicing and reporting to the Hungarian tax authority<\/td>\n<td>1133 Budapest, \u00c1rb\u00f3c utca 6., Hungary<\/td>\n<\/tr>\n<tr>\n<td>Google Ireland Ltd. (Google Workspace)<\/td>\n<td>processor<\/td>\n<td>e-mail, document storage<\/td>\n<td>Gordon House, Barrow Street, Dublin 4, Ireland<\/td>\n<\/tr>\n<tr>\n<td>Defiant, Inc. (Wordfence)<\/td>\n<td>processor<\/td>\n<td>website security, attack filtering (IP address)<\/td>\n<td>USA<\/td>\n<\/tr>\n<tr>\n<td>Automattic, Inc. (Akismet)<\/td>\n<td>processor<\/td>\n<td>spam filtering of forms<\/td>\n<td>USA<\/td>\n<\/tr>\n<tr>\n<td>CookieYes Limited<\/td>\n<td>processor<\/td>\n<td>recording cookie consent<\/td>\n<td>United Kingdom<\/td>\n<\/tr>\n<tr>\n<td>Google Ireland Ltd.<\/td>\n<td>processor (Analytics)<\/td>\n<td>visitor statistics, with consent<\/td>\n<td>Gordon House, Barrow Street, Dublin 4, Ireland<\/td>\n<\/tr>\n<tr>\n<td>Meta Platforms Ireland Ltd.<\/td>\n<td>joint controller (Meta Pixel)<\/td>\n<td>ad measurement, with consent<\/td>\n<td>Merrion Road, Dublin 4, Ireland<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>3.1. <strong>Authorities:<\/strong> the controller may transfer data to authorities (e.g. tax authority, courts, police) where required by law, and to the insurer (Generali Biztos\u00edt\u00f3 Zrt.) in case of damage.<\/p>\n<p>3.2. <strong>Transfers to third countries:<\/strong><\/p>\n<ul>\n<li><strong>United Kingdom<\/strong> (CookieYes): based on the European Commission&#8217;s adequacy decision, without additional safeguards.<\/li>\n<li><strong>USA<\/strong> (Cal.com, Wordfence, Akismet, and the US companies of Google and Meta): under the EU\u2013US Data Privacy Framework where the company participates; otherwise under the Standard Contractual Clauses adopted by the European Commission.<\/li>\n<\/ul>\n<h2>4. Cookies and web analytics<\/h2>\n<p>4.1. The website uses cookies. Strictly necessary cookies are set without consent; all other cookies only with the visitor&#8217;s prior consent (Electronic Communications Act Section 155 (4)). Visitors give consent in the cookie banner and can change or withdraw it at any time with the cookie settings button.<\/p>\n<table>\n<thead>\n<tr>\n<th>Category<\/th>\n<th>Purpose<\/th>\n<th>Example<\/th>\n<th>Legal basis<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Necessary<\/td>\n<td>site operation, security, remembering the cookie choice<\/td>\n<td>CookieYes, Wordfence, language selection (WPML)<\/td>\n<td>legitimate interest, no consent needed<\/td>\n<\/tr>\n<tr>\n<td>Functional<\/td>\n<td>embedded content, sharing<\/td>\n<td>Instagram feed, social sharing buttons<\/td>\n<td>consent<\/td>\n<\/tr>\n<tr>\n<td>Statistics<\/td>\n<td>measuring visits with anonymised IP<\/td>\n<td>Google Analytics<\/td>\n<td>consent<\/td>\n<\/tr>\n<tr>\n<td>Marketing<\/td>\n<td>measuring and targeting ads<\/td>\n<td>Meta Pixel<\/td>\n<td>consent<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>4.2. The exact name, provider and lifetime of each cookie are listed in the automatically updated list available in the cookie banner.<\/p>\n<p>4.3. For the Meta Pixel, the controller and Meta Platforms Ireland Ltd. are joint controllers for collecting and transmitting data to Meta (GDPR Article 26); Meta is responsible for further processing. See facebook.com\/privacy\/policy.<\/p>\n<p>4.4. For visitor statistics of the Dunarama Facebook and Instagram pages, the controller and Meta are also joint controllers.<\/p>\n<h2>5. Data security<\/h2>\n<p>5.1. The controller protects personal data with technical and organisational measures appropriate to the risks (GDPR Article 32):<\/p>\n<ul>\n<li>the website is available over an encrypted (HTTPS) connection;<\/li>\n<li>only authorised staff can access the systems (WordPress, Cal.com, Teya, e-mail), with individual passwords and two-factor authentication where possible;<\/li>\n<li>the website is protected by a firewall and security plugin, and receives regular updates and backups;<\/li>\n<li>the controller does not store bank card data; it is processed exclusively by the payment provider;<\/li>\n<li>paper documents (e.g. complaint records) are kept in a locked place.<\/li>\n<\/ul>\n<p>5.2. <strong>Personal data breach:<\/strong> breaches are recorded, and if they pose a risk, reported to the Hungarian supervisory authority (NAIH) within 72 hours of becoming aware; in case of high risk, the data subjects are also informed without delay (GDPR Articles 33\u201334).<\/p>\n<h2>6. Your rights<\/h2>\n<p>6.1. Requests can be sent to info@dunarama.hu or by post to the registered office. The controller replies within 1 month at the latest; this may be extended by 2 more months where necessary, in which case you will be informed. Information is free of charge; the controller may request identification if in doubt.<\/p>\n<table>\n<thead>\n<tr>\n<th>Right<\/th>\n<th>Meaning<\/th>\n<th>GDPR<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Access<\/td>\n<td>request information and a copy of your data<\/td>\n<td>Art. 15<\/td>\n<\/tr>\n<tr>\n<td>Rectification<\/td>\n<td>request correction or completion of inaccurate data<\/td>\n<td>Art. 16<\/td>\n<\/tr>\n<tr>\n<td>Erasure<\/td>\n<td>request deletion if the purpose has ended or you withdrew consent; data that must be kept by law (e.g. invoices) cannot be deleted<\/td>\n<td>Art. 17<\/td>\n<\/tr>\n<tr>\n<td>Restriction<\/td>\n<td>request that the data is only stored temporarily<\/td>\n<td>Art. 18<\/td>\n<\/tr>\n<tr>\n<td>Portability<\/td>\n<td>receive data processed under contract or consent in a machine-readable format<\/td>\n<td>Art. 20<\/td>\n<\/tr>\n<tr>\n<td>Objection<\/td>\n<td>object to processing based on legitimate interest; to direct marketing at any time<\/td>\n<td>Art. 21<\/td>\n<\/tr>\n<tr>\n<td>Withdrawal of consent<\/td>\n<td>at any time, without reason; this does not affect the lawfulness of earlier processing<\/td>\n<td>Art. 7 (3)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>6.2. You can unsubscribe from the newsletter via the link at the bottom of every e-mail, and change cookie consent with the website&#8217;s cookie settings button.<\/p>\n<h2>7. Remedies and final provisions<\/h2>\n<p>7.1. If you believe the processing infringes your rights, we recommend contacting the controller first (info@dunarama.hu). Independently of this, you can lodge a complaint with the supervisory authority:<\/p>\n<table>\n<thead>\n<tr>\n<th>Hungarian National Authority for Data Protection and Freedom of Information (NAIH)<\/th>\n<th><\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Address<\/td>\n<td>1055 Budapest, Falk Miksa utca 9\u201311., Hungary<\/td>\n<\/tr>\n<tr>\n<td>Postal address<\/td>\n<td>1363 Budapest, Pf. 9.<\/td>\n<\/tr>\n<tr>\n<td>Phone<\/td>\n<td>+36 1 391 1400<\/td>\n<\/tr>\n<tr>\n<td>E-mail<\/td>\n<td>ugyfelszolgalat@naih.hu<\/td>\n<\/tr>\n<tr>\n<td>Website<\/td>\n<td>naih.hu<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>7.2. You may also go to court; you can bring the action before the regional court of your place of residence or stay (Infotv. Section 23).<\/p>\n<p>7.3. The controller updates this notice when laws or its processing change, and publishes the current version on its website. The notice is also available on the booking page and in the website footer.<\/p>\n<p>7.4. Effective from 9 November 2026.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Effective from 9 November 2026. This is an English translation; in case of any discrepancy, the Hungarian version prevails. 1. Controller and legal background 1.1. This notice explains how Dunarama processes the personal data of its guests, customers and website visitors. Item Details Controller Duna Port Szolg\u00e1ltat\u00f3, Ipari \u00e9s Kereskedelmi Korl\u00e1tolt Felel\u0151ss\u00e9g\u0171 T\u00e1rsas\u00e1g (Duna Port [&hellip;]<\/p>\n","protected":false},"author":9,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_top_nav_excluded":false,"_cms_nav_minihome":false,"_cms_nav_section":"","_cms_nav_offsite_url":"","footnotes":""},"class_list":["post-50481","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/dunarama.hu\/en\/wp-json\/wp\/v2\/pages\/50481","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dunarama.hu\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/dunarama.hu\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/dunarama.hu\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/dunarama.hu\/en\/wp-json\/wp\/v2\/comments?post=50481"}],"version-history":[{"count":1,"href":"https:\/\/dunarama.hu\/en\/wp-json\/wp\/v2\/pages\/50481\/revisions"}],"predecessor-version":[{"id":50603,"href":"https:\/\/dunarama.hu\/en\/wp-json\/wp\/v2\/pages\/50481\/revisions\/50603"}],"wp:attachment":[{"href":"https:\/\/dunarama.hu\/en\/wp-json\/wp\/v2\/media?parent=50481"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}