Privacy Policy
Privacy Policy
Fényjáték Szab. Lét. Kft. (hereinafter referred to as the “Data Controller”) hereby provides information on how it processes personal data provided in connection with the website available under the domain neonis-blacklight-minigolf.com (hereinafter referred to as the “Website”), online and telephone bookings, communication, invoicing, and complaint handling.
The purpose of this Privacy Notice is not to obtain consent or acceptance of contractual terms, but to provide data subjects with prior, clear and comprehensible information regarding the processing of their personal data.
The Data Controller processes personal data in particular in accordance with Regulation (EU) 2016/679 (“GDPR”), Act CXII of 2011 on Informational Self-Determination and Freedom of Information (“Infotv.”), and other applicable Hungarian legislation.
1. Details of the Data Controller
Name: Fényjáték Szab. Lét. Kft.
Registered office: 2000 Szentendre, Panoráma u. 1/A, Hungary
Company registration number: 13-09-182563
Tax number: 25732287-2-13
Representative: Hunyadi Éva
Telephone: +36 30 617 6536
E-mail: neonis.info@gmail.com
Website: https://neonis-blacklight-minigolf.com
Data protection contact: Hunyadi Éva – evihunyadi@gmail.com
2. Principles and Scope of the Privacy Notice
The Data Controller processes personal data lawfully, fairly and transparently, solely for specified purposes, and only to the extent and for the period necessary. Appropriate technical and organisational measures are applied to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.
Viewing the Website in general does not require the provision of a name or contact details. However, technical data generated during the operation of the web server may be processed in accordance with Section 3.1.
Where possible, the information required to use the service should be provided by an adult. The Data Controller requests that online bookings or contact made by persons under the age of 16 take place only with the involvement of their legal representative.
3. Individual Data Processing Activities
3.1. Website Visits and Technical Log Data
Data processed: IP address, date and time of the visit, pages viewed and resources requested, browser and device data, operating system, referring page, and data relating to any technical errors.
Purpose: To ensure the secure and stable operation of the Website, troubleshooting, and the detection and prevention of misuse and cyberattacks.
Legal basis: Article 6(1)(f) GDPR – the Data Controller’s legitimate interest in the secure operation of the Website.
Retention period: The data are retained for 30 days following the Website visit.
3.2. Contact via Contact Form, E-mail or Telephone
Data processed: Full name, e-mail address, telephone number, content of the message or enquiry, and any other data voluntarily provided during communication.
Purpose: Responding to enquiries, providing information, coordination and, where necessary, taking steps prior to entering into a contract.
Legal basis: In the case of enquiries relating to a service or booking, Article 6(1)(b) GDPR; in the case of other enquiries, Article 6(1)(f) GDPR – the legitimate interest in responding to enquiries.
Retention period: One year following the closure of the matter, unless longer retention is necessary for the enforcement of legal claims, complaint handling, or another legal obligation.
3.3. Online or Telephone Booking
Data processed: Full name, e-mail address, telephone number, date and time of the booking, number of participants, booking reference, and any comments provided by the data subject.
Purpose: Recording, confirming, modifying or cancelling the booking, communicating with the data subject, and providing the service.
Legal basis: Article 6(1)(b) GDPR – performance of a contract or taking steps at the request of the data subject prior to entering into a contract.
Retention period: Until 30 days after the booked date. The Data Controller may retain data relating to the booking for a longer period if they are required for invoicing, complaint handling, or the enforcement of legal claims.
Consequences of failure to provide data: Without the mandatory information, the booking cannot be recorded or confirmed.
3.4. Invoicing and Issuing Accounting Documents
Data processed: Name or company name, billing address, tax number in the case of an organisation, details of the service and payment, invoice number, and other mandatory accounting information.
Purpose: Issuing, recording and retaining invoices or other accounting documents, and fulfilling tax and accounting obligations.
Legal basis: Article 6(1)(c) GDPR – compliance with a legal obligation applicable to the Data Controller, in particular under Act C of 2000 on Accounting.
Retention period: The statutory retention period applicable to accounting documents, generally 8 years.
3.5. Complaint Handling
Data processed:
In the case of a written complaint: name, postal address or e-mail address, subject of the complaint, detailed content of the complaint, and any attachments.
In the case of an oral or telephone complaint that cannot be resolved immediately: name, residential address or e-mail address, place, time and method of submitting the complaint, detailed description of the complaint, evidence provided, the Data Controller’s position and, in the case of a telephone complaint, the unique identification number.
Purpose: Investigating, responding to and documenting consumer complaints and fulfilling consumer protection obligations.
Legal basis: Article 6(1)(c) GDPR – compliance with a legal obligation, in particular under Act CLV of 1997 on Consumer Protection.
Retention period: The record of the complaint, the written complaint, and a copy of the substantive response provided shall be retained for 3 years.
3.6. Data Subject Requests and Data Protection Administration
Data processed: Data required to identify and communicate with the data subject, the content of the request, and documents and responses generated during the processing of the request.
Purpose: Ensuring the exercise of data subject rights under the GDPR, investigating requests, and demonstrating accountability.
Legal basis: Article 6(1)(c) GDPR – compliance with a legal obligation; regarding the retention of documents relating to closed matters, Article 6(1)(f) GDPR – the handling of legal claims and demonstration of accountability.
Retention period: Five years from the final closure of the request, unless longer retention is justified due to proceedings before a public authority or court.
3.7. Cookies and External Content
The Website may use cookies and similar technologies that are strictly necessary for its operation. Their purpose is to ensure the basic functions, security and session management of the Website.
Cookies that are not strictly necessary, such as statistical, convenience or marketing cookies, may only be used on the basis of the data subject’s prior consent.
The Website may also display embedded maps or other external content. When such content is loaded, the external service provider may receive technical data, in particular the IP address and device information.
The Data Controller must make the loading of external content that is not strictly necessary subject to the data subject’s consent.
4. Data Processors, Recipients and Data Transfers
The Data Controller only uses service providers and other parties that process personal data based on documented instructions, contractual arrangements and appropriate safeguards.
The service providers actually used must be accurately specified before publication of this Privacy Notice.
Service Provider / Processor Identification Details Purpose / Access
Hosting provider …………………. Web hosting, server logs, database and backup management
Website maintenance provider / developer …………………. Technical maintenance, troubleshooting and restricted administrator access
E-mail service provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland E-mail communication and mailbox services
Invoicing software provider ………………………. Invoicing and related data processing
Map service provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland Providing embedded map content where the data subject has consented to its loading
The Data Controller may also transfer personal data to a court, public authority, police authority, tax authority or another body acting under applicable legislation where such transfer is required by law, an official decision, or for the enforcement of the Data Controller’s legal claims.
Where a service provider processes personal data outside the European Economic Area, the transfer may only take place on the basis of an appropriate legal basis and safeguards in accordance with Chapter V of the GDPR, such as an adequacy decision or Standard Contractual Clauses adopted by the European Commission.
5. Data Security
The Data Controller applies security measures appropriate to the risks associated with the processing of personal data, including, where applicable:
access control;
password protection;
regular software and system updates;
backups;
encrypted data transmission;
access logging; and
confidentiality obligations applicable to employees and other staff.
The complete elimination of risks associated with data transmission over the internet cannot be guaranteed. Nevertheless, the Data Controller shall take all measures that can reasonably be expected to ensure the protection of personal data.
In the event of a personal data breach, the Data Controller shall document the incident in accordance with the GDPR, notify the competent supervisory authority where required, and inform the affected data subjects where the breach is likely to result in a high risk to their rights and freedoms.
6. Rights of Data Subjects
Data subjects may exercise the following rights in relation to the processing of their personal data:
Right of access: The data subject may request information as to whether the Data Controller processes their personal data and may request a copy of the personal data being processed.
Right to rectification: The data subject may request the correction of inaccurate personal data and the completion of incomplete personal data.
Right to erasure: The data subject may request the deletion of their personal data where the conditions specified in the GDPR are met. Erasure cannot be requested, for example, where data must be retained due to mandatory accounting obligations.
Right to restriction of processing: The data subject may request that the Data Controller only store their personal data and refrain from other processing activities where the conditions provided by law are met.
Right to data portability: Where processing is based on consent or a contract and is carried out by automated means, the data subject may request the personal data they have provided in a structured, commonly used and machine-readable format, or request their direct transfer to another controller where technically feasible.
Right to object: The data subject may object, on grounds relating to their particular situation, to the processing of their personal data based on legitimate interests. In such cases, the Data Controller may continue processing the data only where compelling legitimate grounds exist or where processing is necessary for the establishment, exercise or defence of legal claims.
Withdrawal of consent: Where processing is based on consent, the data subject may withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Right to lodge a complaint and seek judicial remedy: The data subject may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) and may also seek judicial remedy before a court.
The Data Controller does not carry out solely automated decision-making or profiling that would produce legal effects concerning the data subject or similarly significantly affect them.
7. Exercising Data Subject Rights
Requests may be submitted using one of the following contact details:
E-mail: neonis.info@gmail.com
Postal address: Fényjáték Szab. Lét. Kft., 2000 Szentendre, Panoráma u. 1/A, Hungary
The Data Controller shall provide information on the action taken in response to a request without undue delay and in any event within one month of receipt of the request.
Taking into account the complexity and number of requests, this period may be extended by a further two months. The Data Controller shall inform the data subject of such an extension and the reasons for the delay within the first month.
Information provided and actions taken shall, as a general rule, be free of charge.
Where requests are manifestly unfounded or excessive, in particular because of their repetitive nature, the Data Controller may charge a reasonable fee based on administrative costs or refuse to act on the request.
Where the Data Controller has reasonable doubts concerning the identity of the person making the request, it may request additional information necessary solely to confirm the identity of the data subject.
8. Legal Remedies
If the data subject believes that the processing of their personal data infringes the GDPR or other applicable data protection legislation, they may lodge a complaint with the competent supervisory authority:
Authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, P.O. Box 9, Hungary
E-mail: ugyfelszolgalat@naih.hu
Telephone: +36 1 391 1400
Website: https://www.naih.hu
The data subject may also seek judicial remedy.
In accordance with applicable legislation, legal proceedings may be initiated before the court having jurisdiction according to the data subject’s place of residence or temporary residence, or before the court having jurisdiction according to the registered office of the Data Controller.
9. Amendments to the Privacy Notice
The Data Controller may amend this Privacy Notice, in particular where the method of data processing, the service providers used, the functions of the Website, or the applicable legal environment change.
The version currently in force shall be made available on the Website.
In the event of a material change, the Data Controller shall provide a separate notice drawing attention to the amendment in a manner appropriate to the circumstances.
10. Pre-Publication Checklist
This version is the consolidated and revised structure of the two previous documents.
Before publication, the following information must be checked and completed:
the exact company details of the hosting provider and the actual retention period of server logs;
the details of the website maintenance provider or developer and the extent of their actual access;
the exact details of the invoicing software provider and accountant;
the cookies, embedded content, statistical tools and marketing tools actually used on the Website;
the actual data fields contained in the booking form and the actual deletion practices applicable to booking data;
any separate processing relating to CCTV surveillance, newsletters, prize draws, gift vouchers or online payments, where such services or activities are used.
The purpose of this Privacy Notice is not to obtain consent or acceptance of contractual terms, but to provide data subjects with prior, clear and comprehensible information regarding the processing of their personal data.
The Data Controller processes personal data in particular in accordance with Regulation (EU) 2016/679 (“GDPR”), Act CXII of 2011 on Informational Self-Determination and Freedom of Information (“Infotv.”), and other applicable Hungarian legislation.
1. Details of the Data Controller
Name: Fényjáték Szab. Lét. Kft.
Registered office: 2000 Szentendre, Panoráma u. 1/A, Hungary
Company registration number: 13-09-182563
Tax number: 25732287-2-13
Representative: Hunyadi Éva
Telephone: +36 30 617 6536
E-mail: neonis.info@gmail.com
Website: https://neonis-blacklight-minigolf.com
Data protection contact: Hunyadi Éva – evihunyadi@gmail.com
2. Principles and Scope of the Privacy Notice
The Data Controller processes personal data lawfully, fairly and transparently, solely for specified purposes, and only to the extent and for the period necessary. Appropriate technical and organisational measures are applied to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.
Viewing the Website in general does not require the provision of a name or contact details. However, technical data generated during the operation of the web server may be processed in accordance with Section 3.1.
Where possible, the information required to use the service should be provided by an adult. The Data Controller requests that online bookings or contact made by persons under the age of 16 take place only with the involvement of their legal representative.
3. Individual Data Processing Activities
3.1. Website Visits and Technical Log Data
Data processed: IP address, date and time of the visit, pages viewed and resources requested, browser and device data, operating system, referring page, and data relating to any technical errors.
Purpose: To ensure the secure and stable operation of the Website, troubleshooting, and the detection and prevention of misuse and cyberattacks.
Legal basis: Article 6(1)(f) GDPR – the Data Controller’s legitimate interest in the secure operation of the Website.
Retention period: The data are retained for 30 days following the Website visit.
3.2. Contact via Contact Form, E-mail or Telephone
Data processed: Full name, e-mail address, telephone number, content of the message or enquiry, and any other data voluntarily provided during communication.
Purpose: Responding to enquiries, providing information, coordination and, where necessary, taking steps prior to entering into a contract.
Legal basis: In the case of enquiries relating to a service or booking, Article 6(1)(b) GDPR; in the case of other enquiries, Article 6(1)(f) GDPR – the legitimate interest in responding to enquiries.
Retention period: One year following the closure of the matter, unless longer retention is necessary for the enforcement of legal claims, complaint handling, or another legal obligation.
3.3. Online or Telephone Booking
Data processed: Full name, e-mail address, telephone number, date and time of the booking, number of participants, booking reference, and any comments provided by the data subject.
Purpose: Recording, confirming, modifying or cancelling the booking, communicating with the data subject, and providing the service.
Legal basis: Article 6(1)(b) GDPR – performance of a contract or taking steps at the request of the data subject prior to entering into a contract.
Retention period: Until 30 days after the booked date. The Data Controller may retain data relating to the booking for a longer period if they are required for invoicing, complaint handling, or the enforcement of legal claims.
Consequences of failure to provide data: Without the mandatory information, the booking cannot be recorded or confirmed.
3.4. Invoicing and Issuing Accounting Documents
Data processed: Name or company name, billing address, tax number in the case of an organisation, details of the service and payment, invoice number, and other mandatory accounting information.
Purpose: Issuing, recording and retaining invoices or other accounting documents, and fulfilling tax and accounting obligations.
Legal basis: Article 6(1)(c) GDPR – compliance with a legal obligation applicable to the Data Controller, in particular under Act C of 2000 on Accounting.
Retention period: The statutory retention period applicable to accounting documents, generally 8 years.
3.5. Complaint Handling
Data processed:
In the case of a written complaint: name, postal address or e-mail address, subject of the complaint, detailed content of the complaint, and any attachments.
In the case of an oral or telephone complaint that cannot be resolved immediately: name, residential address or e-mail address, place, time and method of submitting the complaint, detailed description of the complaint, evidence provided, the Data Controller’s position and, in the case of a telephone complaint, the unique identification number.
Purpose: Investigating, responding to and documenting consumer complaints and fulfilling consumer protection obligations.
Legal basis: Article 6(1)(c) GDPR – compliance with a legal obligation, in particular under Act CLV of 1997 on Consumer Protection.
Retention period: The record of the complaint, the written complaint, and a copy of the substantive response provided shall be retained for 3 years.
3.6. Data Subject Requests and Data Protection Administration
Data processed: Data required to identify and communicate with the data subject, the content of the request, and documents and responses generated during the processing of the request.
Purpose: Ensuring the exercise of data subject rights under the GDPR, investigating requests, and demonstrating accountability.
Legal basis: Article 6(1)(c) GDPR – compliance with a legal obligation; regarding the retention of documents relating to closed matters, Article 6(1)(f) GDPR – the handling of legal claims and demonstration of accountability.
Retention period: Five years from the final closure of the request, unless longer retention is justified due to proceedings before a public authority or court.
3.7. Cookies and External Content
The Website may use cookies and similar technologies that are strictly necessary for its operation. Their purpose is to ensure the basic functions, security and session management of the Website.
Cookies that are not strictly necessary, such as statistical, convenience or marketing cookies, may only be used on the basis of the data subject’s prior consent.
The Website may also display embedded maps or other external content. When such content is loaded, the external service provider may receive technical data, in particular the IP address and device information.
The Data Controller must make the loading of external content that is not strictly necessary subject to the data subject’s consent.
4. Data Processors, Recipients and Data Transfers
The Data Controller only uses service providers and other parties that process personal data based on documented instructions, contractual arrangements and appropriate safeguards.
The service providers actually used must be accurately specified before publication of this Privacy Notice.
Service Provider / Processor Identification Details Purpose / Access
Hosting provider …………………. Web hosting, server logs, database and backup management
Website maintenance provider / developer …………………. Technical maintenance, troubleshooting and restricted administrator access
E-mail service provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland E-mail communication and mailbox services
Invoicing software provider ………………………. Invoicing and related data processing
Map service provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland Providing embedded map content where the data subject has consented to its loading
The Data Controller may also transfer personal data to a court, public authority, police authority, tax authority or another body acting under applicable legislation where such transfer is required by law, an official decision, or for the enforcement of the Data Controller’s legal claims.
Where a service provider processes personal data outside the European Economic Area, the transfer may only take place on the basis of an appropriate legal basis and safeguards in accordance with Chapter V of the GDPR, such as an adequacy decision or Standard Contractual Clauses adopted by the European Commission.
5. Data Security
The Data Controller applies security measures appropriate to the risks associated with the processing of personal data, including, where applicable:
access control;
password protection;
regular software and system updates;
backups;
encrypted data transmission;
access logging; and
confidentiality obligations applicable to employees and other staff.
The complete elimination of risks associated with data transmission over the internet cannot be guaranteed. Nevertheless, the Data Controller shall take all measures that can reasonably be expected to ensure the protection of personal data.
In the event of a personal data breach, the Data Controller shall document the incident in accordance with the GDPR, notify the competent supervisory authority where required, and inform the affected data subjects where the breach is likely to result in a high risk to their rights and freedoms.
6. Rights of Data Subjects
Data subjects may exercise the following rights in relation to the processing of their personal data:
Right of access: The data subject may request information as to whether the Data Controller processes their personal data and may request a copy of the personal data being processed.
Right to rectification: The data subject may request the correction of inaccurate personal data and the completion of incomplete personal data.
Right to erasure: The data subject may request the deletion of their personal data where the conditions specified in the GDPR are met. Erasure cannot be requested, for example, where data must be retained due to mandatory accounting obligations.
Right to restriction of processing: The data subject may request that the Data Controller only store their personal data and refrain from other processing activities where the conditions provided by law are met.
Right to data portability: Where processing is based on consent or a contract and is carried out by automated means, the data subject may request the personal data they have provided in a structured, commonly used and machine-readable format, or request their direct transfer to another controller where technically feasible.
Right to object: The data subject may object, on grounds relating to their particular situation, to the processing of their personal data based on legitimate interests. In such cases, the Data Controller may continue processing the data only where compelling legitimate grounds exist or where processing is necessary for the establishment, exercise or defence of legal claims.
Withdrawal of consent: Where processing is based on consent, the data subject may withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Right to lodge a complaint and seek judicial remedy: The data subject may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) and may also seek judicial remedy before a court.
The Data Controller does not carry out solely automated decision-making or profiling that would produce legal effects concerning the data subject or similarly significantly affect them.
7. Exercising Data Subject Rights
Requests may be submitted using one of the following contact details:
E-mail: neonis.info@gmail.com
Postal address: Fényjáték Szab. Lét. Kft., 2000 Szentendre, Panoráma u. 1/A, Hungary
The Data Controller shall provide information on the action taken in response to a request without undue delay and in any event within one month of receipt of the request.
Taking into account the complexity and number of requests, this period may be extended by a further two months. The Data Controller shall inform the data subject of such an extension and the reasons for the delay within the first month.
Information provided and actions taken shall, as a general rule, be free of charge.
Where requests are manifestly unfounded or excessive, in particular because of their repetitive nature, the Data Controller may charge a reasonable fee based on administrative costs or refuse to act on the request.
Where the Data Controller has reasonable doubts concerning the identity of the person making the request, it may request additional information necessary solely to confirm the identity of the data subject.
8. Legal Remedies
If the data subject believes that the processing of their personal data infringes the GDPR or other applicable data protection legislation, they may lodge a complaint with the competent supervisory authority:
Authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, P.O. Box 9, Hungary
E-mail: ugyfelszolgalat@naih.hu
Telephone: +36 1 391 1400
Website: https://www.naih.hu
The data subject may also seek judicial remedy.
In accordance with applicable legislation, legal proceedings may be initiated before the court having jurisdiction according to the data subject’s place of residence or temporary residence, or before the court having jurisdiction according to the registered office of the Data Controller.
9. Amendments to the Privacy Notice
The Data Controller may amend this Privacy Notice, in particular where the method of data processing, the service providers used, the functions of the Website, or the applicable legal environment change.
The version currently in force shall be made available on the Website.
In the event of a material change, the Data Controller shall provide a separate notice drawing attention to the amendment in a manner appropriate to the circumstances.
10. Pre-Publication Checklist
This version is the consolidated and revised structure of the two previous documents.
Before publication, the following information must be checked and completed:
the exact company details of the hosting provider and the actual retention period of server logs;
the details of the website maintenance provider or developer and the extent of their actual access;
the exact details of the invoicing software provider and accountant;
the cookies, embedded content, statistical tools and marketing tools actually used on the Website;
the actual data fields contained in the booking form and the actual deletion practices applicable to booking data;
any separate processing relating to CCTV surveillance, newsletters, prize draws, gift vouchers or online payments, where such services or activities are used.