DATA MANAGEMENT NOTICE

MIDMAR Nonprofit Ltd.

In accordance with Articles 13-14 of the General Data Protection Regulation (GDPR) of the European Parliament and Council (EU) 2016/679, we would like to inform you about certain aspects of data processing carried out by our company.

The data controller

Name:

MIDMAR Miskolc Tourism Marketing Nonprofit Public Benefit Ltd.

Email:

info@visitmiskolc.hu

Phone:

+36 46 350 425

Registered address:

3530 Miskolc, Széchenyi St. 16.

Company registration number:

05-09-024717

Tax number:

24113917-2-05

A(hereinafter referred to as MIDMAR or data controller)

Our Data Protection Officer: Dr. Eszter Csillag, gdpr@miskolc.hu; eszter@powersec.hu, +36 20A822 7008.
The data controller processes the personal data of the data subject for the purposes defined in this notice and to the extent necessary to achieve these purposes. Regarding data processing, the personal data of the data subject may be accessed by authorised employees of the data controller. Only those employees whose job responsibilities require them to handle specific personal data are authorised to access it. The data controller does not make decisions based on automated data processing or conduct profiling.
If data processing takes place through our websites (https://www.visitmiskolc.hu/ or https://www.miskolcpass.com/), by using the website, you accept the terms outlined in this privacy notice. If you do not accept the terms of this privacy notice, please refrain from using the website. Additional information regarding data processing related to cookies used on the website can be found in the online data processing information (miskolcpass.com / www.visitmiskolc.hu).
The following important information applies to data processing:

A) Miskolc Pass Classic Card

Data subjects

Holders of the Miskolc Pass Classic Card

Purpose of data processing

Operation of the card system, identification of cardholders, management of discounts

Scope of processed data

Data necessary for identification (name, birth name, residence, postal address, ID card number, place and date of birth, mother’s full birth name)

Legal basis for data processing

Performance of a contract

Duration of data processing

Data processing continues for three years after the expiry of the validity of the Miskolc Pass Classic Card

Mandatory or voluntary nature of data provision

You are not obliged to provide your data; however, we can only issue the Miskolc Pass Classic Card if you consent to the processing of your personal data.

Data transfer

Miskolc Holding Zrt., Municipality of Miskolc City with County Rights, for supervisory purposes, on the www.visitmiskolc.hu, www.miskolcpass.hu websites, and to the acceptance points listed in Annex 1 of this notice, for the purpose of verifying the validity of the card.

Data processors

Qilaq Solutions Ltd. (8623 Balatonföldvár, Móricz Zsigmond Street 26. Building B, data processing activity: operation of the card system), Miskolc Holding Zrt. (3530 Miskolc, Petőfi Street 1-3., data processing activity: IT security backups of the data controller’s system), MVK Zrt. (3527 Miskolc, Szondi György Street 1., data processing activity: verification of eligibility for public transport use with the card)

B) Miskolc Pass Tourist Card

Data subjects

Holders of the Miskolc Pass Tourist Card

Purpose of data processing

Operation of the card system, identification of cardholders, management of discounts

Scope of processed data

Data necessary for identification (name, date of birth)

Legal basis for data processing

Performance of a contract

Duration of data processing

Data processing continues for three years after the expiry of the validity of the Miskolc Pass Tourist Card

Mandatory or voluntary nature of data provision

You are not obliged to provide your data. However, if you do not provide your data, we cannot issue the Miskolc Pass Tourist Card.

Data transfer

Data processors

ELECTRONIC DELIVERY OF THE MISKOLC PASS CLASSIC AND TOURIST CARDS

Data subjects

Holders of the Miskolc Pass Classic and Tourist Cards

Purpose of data processing

Electronic delivery of the discount card

Scope of processed data

Data necessary for electronic delivery (email address)

Legal basis for data processing

The data subject’s consent

Duration of data processing

The email address is processed until the email is sent for electronic delivery purposes

Mandatory or voluntary nature of data provision

You are not obliged to provide your data. However, if you do not provide your data, we cannot electronically deliver the Miskolc Pass Classic / Tourist Card.

Data processors

NEWSLETTER DISTRIBUTION

Data subjects

Individuals who have consented to receive newsletters from MIDMAR

Purpose of data processing

Providing information about MIDMAR’s tourism-related programmes and events, as well as tourism opportunities and programmes offered by companies associated with the data controller through MIDMAR Ltd.

Scope of processed data

Data necessary for contact (name, email address)

Legal basis for data processing

The data subject’s consent

Duration of data processing

Until consent is withdrawn. Consent can be withdrawn by sending an email to the data controller’s electronic contact (info@visitmiskolc.hu) or by sending a letter requesting unsubscription to 3525 Miskolc, Városház tér 8.

Mandatory or voluntary nature of data provision

You are not obliged to provide your data. However, we can only provide information if you provide your data and give your consent.

Data processors

Miskolc Holding Zrt. (3530 Miskolc, Petőfi Street 1-3., data processing activity: IT security backups of the data controller’s system), Mimézis Ltd. (8600 Siófok, Kristály Street 12., data processing activity: operation of the interface managing newsletter distribution)

DATA PROCESSING RELATED TO INVOICING

Data subjects

Natural persons contracting with the data controller

Purpose of data processing

Maintaining records of invoicing data based on the contract between the data controller and the data subject

Scope of processed data

Data necessary for identification (name, address, email address, phone number)

Legal basis for data processing

The legal obligation to issue and retain accounting documents

Duration of data processing

Eight years following the termination of the contract, based on the obligation to retain accounting documents.

Mandatory or voluntary nature of data provision

The provision of personal data necessary for identification and tax-related identification numbers is a precondition for concluding the contract and is required by law. Without this data, we cannot conclude a contract with you.

DECLARATION REGARDING LOST CARDS

Data subjects

Natural persons contracting with the data controller regarding the Miskolc Pass Classic or Tourist Card

Purpose of data processing

Invalidating lost cards and issuing new ones

Scope of processed data

Data necessary for identification (name, date of birth, address, mother’s name, signature)

Legal basis for data processing

Performance of the contract related to the card between the data controller and the data subject

Duration of data processing

One year following the card cancellation based on the declaration

Mandatory or voluntary nature of data provision

Data provision is voluntary, but without the declaration, we cannot issue a new card.

PHOTOGRAPHY / AUDIO RECORDING AT EVENTS

Data subjects

Individuals appearing in photos and possible video recordings taken at events organised by the data controller or invited media outlets.

Purpose of data processing

§ Promoting the data controller’s events, marketing communication purposes

§ Informing the public about the event

§ Media coverage and use by the press

Scope of processed data

Image, audio, other personal data appearing in recordings. In the case of written consent, the data subject’s name, address, and signature.

Legal basis for data processing

We inform attendees that by participating in events organised by MIDMAR, they consent to the taking of photographs, video recordings, and audio recordings by MIDMAR and/or various media outlets, as well as their publication and use by the press.

Accordingly, the legal basis for data processing related to recordings is:

§ The data subject’s consent, which can be given through implied conduct (such as entering a room where they are aware recordings are being made or may be made) or explicit declaration.

§ Consent is not required for taking and using photographs and video recordings in the case of mass recordings and public appearances.

Duration of data processing

Data processing continues until the data subject’s request for deletion is fulfilled or the data is deleted as a result of the data subject’s objection.

Mandatory or voluntary nature of data provision

You are not obliged to consent to the taking and use of photographs and video recordings. However, in such cases, you may not be able to participate in certain events. You can object to the use of already taken photographs or video recordings or request their deletion from the data controller at any time.

Data transfer

Recordings may be transferred to media representatives. Individual media outlets may use the recordings for mass communication purposes in accordance with the provisions of Act CLXXXV of 2010 on Media Services and Mass Communication and Act CIV of 2010 on the Freedom of the Press and the Basic Rules of Media Content. Upon request, the data controller will provide information about which event recordings were transferred to which media outlets.

We draw attention to the fact that media representatives may also take photographs, video recordings, and audio recordings directly at events.

DATA PROCESSING FOR BUSINESS CONTACTS OF COMPANIES CONTRACTING WITH THE DATA CONTROLLER

Data subjects

Employees of third parties contracting with the data controller or individuals in other work-related relationships with them who act as contact persons in fulfilling the contract

Purpose of data processing

§ Ensuring smooth and seamless communication during contractual relationships through contact persons, which requires the data controller to know the contact persons’ data.

§ Direct business acquisition targeting the company as the recipient of advertising, provided the data subject does not object to the data processing.

Scope of processed data

Data necessary for contact (name, email address, phone number, associated company/institution name, and possibly position)

Source of data

Directly from the data subject or the company contracting with the data controller

Legal basis for data processing

The legal basis for data processing is the data controller’s legitimate interest. Legitimate interest includes (i) ensuring communication necessary for fulfilling contracts with third parties and (ii) direct business acquisition for business-related (not addressed to natural persons) offers or advertisements (Recital 47 of the GDPR). The data controller provides the option to object (unsubscribe), so if the data subject declares that they do not wish to receive advertising-related communications from the data controller, their data will be deleted and will not be used for this purpose.

Duration of data processing

§ Maintaining records of contact persons’ data, offers, other written and email communications: five years from the termination of the contract

§ Contracts, orders, and invoices, if they contain the data subject’s data: eight years from the termination of the contract, based on the obligation to retain accounting documents.

§ In the case of direct business acquisition, data processing continues until the data subject objects.

Mandatory or voluntary nature of data provision

You are generally not obliged to provide your personal data to us. However, if you are a contact person, the processing of your data may be necessary for fulfilling the contract, and without it, the contract may face obstacles, potentially leading to its termination.

COMPLAINT HANDLING

Data subjects

Customers lodging complaints

Purpose of data processing

Filling out a complaint record, maintaining contact with the complainant, investigating the complaint

Scope of processed data

Data required by law for handling complaints (complainant’s name, postal address, email address, signature)

Legal basis for data processing

§ Compliance with a legal obligation under Section 17/A (5) of Act CLV of 1997 on Consumer Protection

§ The legal basis for processing the complainant’s email address is their consent

Duration of data processing

§ Five years, under Section 17/A (7) of Act CLV of 1997 on Consumer Protection

§ Processing of the email address continues until consent is withdrawn, but for a maximum of five years

Mandatory or voluntary nature of data provision

In the case of a complaint, you are required by law to provide your data to facilitate effective investigation of the complaint.

Data processors

Miskolc Holding Zrt. (3530 Miskolc, Petőfi Street 1-3., data processing activity: IT security backups of the data controller’s system)

DATA PROCESSING FOR INDIVIDUALS SUBMITTING JOB APPLICATIONS TO MIDMAR

Data subjects

Individuals applying for a job at the data controller or selected for a specific job advertisement

Purpose of data processing

§ Data processing for the purpose of assessing the applicant’s professional suitability for the advertised position until the evaluation of the application. Where the collection of specific personal data serves a different purpose, this is explicitly indicated in the following section.

§ Data processing following the evaluation of the application for the purpose of direct contact regarding further job opportunities, provided the data subject has consented to this.

Scope of processed data

§ Name, place and date of birth, nationality, permanent address, residence (purpose of data processing: identification of the applicant)

§ Phone number, email address (purpose of data processing: contact)

§ Details of the applied position

§ Educational qualifications

§ Professional experience

§ Language skills (in the case of intellectual positions)

§ Salary expectations

§ Public profile on social media (e.g., LinkedIn), if the information provided there is relevant to the applied position

§ If necessary: CV and the data contained therein, e.g.

§ Photograph, if included in the CV

§ Personal identification data (name, gender, place and date of birth, nationality)

§ Language skills, educational and other qualifications, professional experience, preferred position, area of interest

§ If applicable, type of driver’s licence, and

§ Other data included in the CV.

§ If necessary: Cover letter and its content. Please do not include data in your CV or cover letter that is not relevant to the establishment of an employment relationship!

Legal basis for data processing

The applicant’s consent. Please note that you are not obliged to give your consent. However, if you do not consent to data processing for recruitment purposes, we cannot evaluate your job application. If you have given your consent, you can withdraw it at any time without justification. Withdrawal does not affect the lawfulness of data processing carried out prior to the withdrawal.

Duration of data processing

§ In the case of an unsuccessful application, 90 days after the evaluation of the job application, provided the data subject has not consented to further contact.

§ If the data subject has consented, or the data subject has not applied for a specific job, the CV (application) will be retained and used for two years for the purpose of notifying about job opportunities.

§ In the case of a successful application, the data provided during the application process that is necessary for establishing and maintaining the employment relationship will be further processed by the data controller, as outlined in a separate notice for employees.

Information on data transfers

The data controller does not plan to transfer the personal data of the data subject to third countries (non-EEA member states). The data controller may transfer the personal data of the data subject to its contracting partners for the purpose of fulfilling the contract with the data subject or for supervisory purposes. Additionally, the data of the data subject may be transferred on an ad hoc basis to service providers contracted by the data controller, such as lawyers, auditors, or financial advisors, if this is absolutely necessary, e.g., in connection with a legal dispute or the financial or accounting assessment of an economic event. These service providers are bound by professional or contractual confidentiality obligations.

Rights of the data subject

Right to information: The data subject may request information about data processing concerning them at any time using the contact details provided in this notice. They may request the rectification, deletion, or restriction of processing of their data and object to the processing of such personal data.

Right of access: Upon request, the data controller will inform the data subject whether their personal data is being processed. If so, the data subject is entitled to access the personal data processed about them, as well as information on the purpose of the processing, the categories of data concerned, the recipients or categories of recipients to whom the data has been or will be disclosed, the planned duration of processing or the criteria for determining this duration, and the source of the data.

Upon request, the data controller will provide the data subject with a copy of the personal data being processed. For additional copies requested by the data subject, a reasonable fee based on administrative costs may be charged. If the request is submitted electronically, the information must be provided in a commonly used electronic format unless the data subject requests otherwise.

Right to rectification: The data subject may request the rectification of inaccurate data and has the right to request the completion of incomplete data.

Right to withdraw consent: The data subject has the right to withdraw their consent to the processing of their personal data at any time, with effect for the future. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Right to erasure: The data subject may request the deletion of their personal data if

the data is no longer necessary for the purpose for which it was collected or otherwise processed;
the data subject withdraws their consent, and there is no other legal basis for processing;
the data subject objects to processing, and there are no overriding legitimate grounds for processing;
the processing is unlawful;
the data must be deleted to comply with a legal obligation to which the data controller is subject;
the data subject is under the age of 16.

The data controller will delete the data upon such a request unless further processing is necessary for

compliance with a legal obligation to which the data controller is subject,
the establishment, exercise, or defence of legal claims.

Right to restriction of processing: The data subject may request restriction of processing if

the data subject contests the accuracy of the personal data; in this case, the restriction applies for the period necessary to verify the accuracy of the data,
the processing is unlawful, but the data subject opposes the deletion of the data and requests restriction instead,
the data controller no longer needs the data for processing purposes, but the data subject requires it for the establishment, exercise, or defence of legal claims,
the data subject has objected to processing, in which case the restriction applies until it is determined whether the data controller’s legitimate grounds override those of the data subject.

If processing is restricted as described above, such personal data – with the exception of storage – may only be processed with the data subject’s consent or for the establishment, exercise, or defence of legal claims, or for the protection of the rights of another person, or for reasons of important public interest of the European Union or a Member State. The data controller will inform the data subject who requested the restriction before lifting the restriction.

The data controller will notify the data subject and all recipients to whom the data has been disclosed of any rectification, deletion, or restriction of processing, unless this proves impossible or involves disproportionate effort. If the data controller has made the personal data public and is obliged to delete it, they will take reasonable steps – including technical measures – to inform other controllers processing the data that the data subject has requested the deletion of any links to, or copies or replications of, the data in question.

Right to object: The data subject may object to the processing of their personal data

a) if it is based on legitimate interest; in this case, processing may not continue unless there are compelling legitimate grounds for processing that override the data subject’s interests, rights, and freedoms, or for the establishment, exercise, or defence of legal claims,
b) if it is for direct marketing purposes or related to such purposes; in this case, processing for this purpose may no longer continue.

Right to data portability: The data subject may request that the data controller provide their personal data in a structured, commonly used, and machine-readable format and, if technically feasible, transmit it to another controller. Alternatively, the data subject may request the transmission directly from the data controller.

Right to lodge a complaint: If the data subject believes that their rights related to personal data have been violated, they are encouraged to report their complaint to the data controller or the Data Protection Officer using the contact details provided above.

The data subject may also lodge a complaint with the competent authority. If they choose to do so, they can submit their complaint to the authority at the following contact details:

National Authority for Data Protection and Freedom of Information

Address: 1055 Budapest, Falk Miksa Street 9-11.

Postal address: 1363 Budapest, Pf.: 9.

Phone: +36 -1-391-1400

Fax: +36-1-391-1410

Email: ugyfelszolgalat@naih.hu

If the data subject experiences unlawful data processing, they may also initiate a civil lawsuit. The court of jurisdiction is the competent tribunal. The lawsuit may also be initiated at the tribunal of the data subject’s place of residence (a list of tribunals and their contact details can be found at http://birosag.hu/torvenyszekek).

Investigation of claims

The data controller will inform the data subject of measures taken in response to their request without undue delay and in any case within one month of receiving the request. If necessary, taking into account the complexity of the request and the number of requests, this period may be extended by a further two months. The data controller will inform the data subject of the extension and the reasons for the delay within one month of receiving the request. If the request was submitted electronically, the information will be provided electronically where possible, unless the data subject requests otherwise. If we determine that no action is required in response to the data subject’s request, we will inform them of the reasons for this decision and their right to lodge a complaint with the data protection authority or seek judicial remedy within one month of receiving the request.

Requests are free of charge, but if a request is manifestly unfounded or excessive, particularly due to its repetitive nature, the data controller may charge a reasonable fee based on administrative costs or refuse to act on the request.

If there are reasonable doubts about the identity of the individual making the request, additional information necessary to confirm their identity may be requested.

Effective: 18 February 2025.

MIDMAR Nonprofit Ltd.

Annex

Data transfers related to the Miskolc Pass Classic and Tourist Cards

In connection with the operation of the card system, the data controller transfers the cardholder’s card data to the following entities for the purpose of verifying the validity of the card:

Anyukám Mondta Ltd. – Pizza, Coffee, World Peace

Registered address: 3860 Encs, Petőfi St. 57.

Tax number: 11701279-2-05

Aura Gold Ltd. - Calimbra Wellness and Conference Hotel

Registered address: 3519 Miskolc, Bencések St. 9-11.

Tax number: 14002627-2-05

Auto-Tapolca Ltd. – Zenit Guesthouse

Registered address: 3519 Miskolc, Miskolctapolcai St. 25-27.

Tax number: 11588779-2-05

Bankó-Stúdió Ltd. – Canon Cartridge Discount

Registered address: 3525 Miskolc, Jókai St. 5.

Tax number: 10738737-2-05

Belvárosi Oroszlán Pharmacy Bt.

Registered address: 3530 Miskolc, Széchenyi St. 76.

Tax number: 21319114-2-05

Bükk Artisan Wines Ltd. – Zsolt Sándor Organic Vineyard and Winery

Registered address: 3526 Miskolc, Huba St. 7.

Tax number: 24306458-2-05

Bükk National Park Directorate – Szeleta Park Visitor Centre, Anna Cave, St. Stephen’s Cave

Registered address: 3304 Eger, Sánc St. 6.

Tax number: 15323864-2-10

Corneo Eco Ltd. - Cat’s Eye Optics

Registered address: 3821 Keresztéte, Main St. 12.

Tax number: 23916889-2-05

Diósgyőri Várkert Ltd. – Diósgyőri Várkert Guesthouse

Registered address: 3535 Miskolc, Tapolcarét St. 2/a.

Tax number: 11995223-2-05

Grandette Perfect Hospitality and Service Ltd. - Renomé Café & Bistro

Registered address: 3525 Miskolc, Dayka Gábor St. 13/A Ground Floor 4.

Tax number: 32346741-2-05

Gold Park Ltd. - Kikelet Club Hotel***

Registered address: 3519 Miskolc, Fenyő St. 7.

Tax number: 11584500-2-05

Herman Ottó Museum

Registered address: 3529 Miskolc, Görgey Artúr St. 28.

Tax number: 15350851-2-05

Íz-Kalauz Ltd. – Végállomás Bistro & Wine

Registered address: 3535 Miskolc, Fülepp József St. 40.

Tax number: 239473752-05

Ferenc Katona e.v.

Registered address: 3517 Miskolc-Szentlélek, Kültelek 1105/1 hrsz.

Tax number: 45398463-1-25

Leves Gastronomy Workshop Ltd. – A Leves and Borsod Burger

Registered address: 3525 Miskolc, Széchenyi István St. 89.

Tax number: 24979195-2-05

Libegőpark Ltd.

Registered address: 3517 Miskolc, Erzsébet Promenade 77.

Tax number: 23449561-2-05

Miskolc Baths Ltd.

Registered address: 3519 Miskolc, Pazár István Promenade 1.

Tax number: 14140549-2-05

Miskolc National Theatre Nonprofit Ltd.

Registered address: 3525 Miskolc, Déryné St. 1.

Tax number: 23862474-2-05

Miskolc Sports Centre Ltd. – Kemény Dénes Sports Swimming Pool

Registered address: 3515 Miskolc, University St. 2.

Tax number: 24364577-2-05

Miskolc Symphony Orchestra Nonprofit Ltd.

Registered address: 3525 Miskolc, Fábián St. 6/a.

Tax number: 23834967-2-05

Miskolc City Manager Nonprofit Ltd. - Miskolc Zoo

Registered address: 3531 Miskolc, Győri Gate 48-50.

Tax number: 20643522-5-05

MVK Miskolc City Transport Private Limited Company

Registered address: 3527 Miskolc, Szondi György St. 1.

Tax number: 11072315-2-05

OSTI Ltd. - Alfa Hotel*** Superior

Registered address: 3519 Miskolc, Fenyő St. 17.

Tax number: 10512485-2-05

Palacsízió Ltd. - Creppy Pancake House Restaurant and Creppy Center Event Hall

Registered address: 3530 Miskolc, Nagyavasi Cellar Row 212.

Tax number: 24688563-2-05

Pop-Sarok Bt. – Pop-Sarok Gift Shop

Registered address: 3530 Miskolc, Szemere St. 3. Ground Floor 5.

Tax number: 29549236-2-05

Premium Oven Inn Ltd. – Tapolca Inn, Kemencés Kisvendéglő

Registered address: 3519 Miskolc, Csabai St. 36.

Tax number: 25372687-2-05

S.S. Club Ltd. Impresszó Club - Restaurant

Registered address: 3530 Miskolc, Széchenyi I. St. 94. 2/6

Tax number: 12756894-2-05

RIPEKU Consulting Ltd. – Józan Driver - Driver Service Miskolc

Registered address: 3526 Miskolc, Pozsonyi St. 88. 1st Floor 2.

Tax number: 27487165-2-05

Steelvent Ltd. - Dűlő Restaurant

Registered address: 3527 Miskolc, Besenyői St. 8.

Tax number: 11883995-2-05

Szabó and Partner Ltd. - Hotel Tókert and Restaurant

Registered address: 3517 Miskolc-Lillafüred Erzsébet Promenade 3.

Tax number: 11389075-2-05

TOP-ROOM Ltd. - Aranykorona Historical Restaurant, Hotel, and Show Cellar

Registered address: 3530 Miskolc Kisavas First Row 19-20.

Tax number: 11589268-2-05

VITÁL-LAND Service Social Cooperative - Miskolctapolca Adventure Park

Registered address: 3519 Miskolctapolca, Garas Sámuel St.

Tax number: 25296345105

Wondex Ltd. - Wondex Creative & Stationery

Registered address: 3526 Miskolc, Szeles St. 29.

Tax number: 11066640-2-05

Featured tourism partners