Privacy Policy
Effective: 14 May 2026
This policy describes the data processing practices of the Teniszpálya Szigliget website (www.szigliget-tennis.hu) and its online booking system, in accordance with EU Regulation 2016/679 (GDPR).
1. Data Controller
Szigliget Tenisz Club Kft. (Szigliget Tenisz Club Szolgáltató Korlátolt Felelősségű Társaság)
Address: 8264 Szigliget, Réhelyi út 31-32., Hungary
Company reg. no.: Cg.19-09-501339
Tax number: 11326683-1-19 | EU VAT: HU11326683
Representatives: Werner Blödorn, Eszter Blödorn Werner, Zsolt Uhri, Péter Krisztián Blödorn (independent signing right)
E-mail: szigligettenisz@gmail.com
Phone: +36-20-331-1630
Web: www.szigliget-tennis.hu
Data Protection Officer: Not required under GDPR Art. 37 given the nature and scale of our activities. For data protection enquiries, use the contacts above.
2. Personal Data Processed and Purposes
2.1. Registration and User Account
When creating a user account, we process the following data:
| Data | Purpose | Legal Basis |
|---|---|---|
| Last name, first name | Identification, personalised communication | Contract [GDPR 6(1)(b)] |
| E-mail address | Login, transactional notifications | Contract [GDPR 6(1)(b)] |
| Phone number | Contact for booking-related matters | Contract [GDPR 6(1)(b)] |
| Password (bcrypt hash) | Login security; original password never stored | Contract [GDPR 6(1)(b)] |
| Preferred language | Interface and e-mail language (HU/EN/DE) | Contract [GDPR 6(1)(b)] |
| E-mail verification token | One-time confirmation after registration; deleted after confirmation | Contract [GDPR 6(1)(b)] |
| Home address (country, postcode, city, street/house no., floor/door) | Identification and invoicing | Contract [GDPR 6(1)(b)] |
| Billing details (if different from home address) | Issuing electronic invoices | Contract + legal obligation [GDPR 6(1)(b)+(c)] |
| Tax number / EU VAT number (companies, optional) | Issuing invoices with tax number | Contract + legal obligation [GDPR 6(1)(b)+(c)] |
Providing the data above is required to use the service. Without them, account creation and service provision are not possible.
2.2. Login and Session
- Session data – to maintain logged-in state until the browser is closed
- "Remember me" token – 30-day cookie if the option is selected
- IP address – rate limiting only; stored for at most 15 minutes
Legal basis: GDPR Art. 6(1)(f) – legitimate interest (security, abuse prevention).
2.3. Court Booking
- Booking details: court number, date, time slot, status (pending / confirmed / cancelled)
- Cancellation token (one-use link sent by e-mail)
- Number of non-member players (for member pricing)
Legal basis: GDPR Art. 6(1)(b) – performance of a contract.
2.4. Payment
- Payment transaction ID, amount and status – for confirmation and records
- Bank card data – processed exclusively by Barion Payment Zrt.; our website has no access to card details
Legal basis: GDPR Art. 6(1)(b) (contract) and Art. 6(1)(c) (legal obligation – accounting records).
2.5. Club Membership
- Membership type (adult, pair, family, youth, child) and expiry date
Legal basis: GDPR Art. 6(1)(b) – performance of a contract.
For youth and child memberships, a person under 16 may only be registered by the holder of parental responsibility (legal guardian), who explicitly confirms they have the authority to provide the data (GDPR Art. 8).
2.6. Password Reset
- Password reset token – one-use, valid 1 hour; requesting IP stored for rate limiting for up to 1 hour
Legal basis: GDPR Art. 6(1)(f) – legitimate interest (account security).
2.7. Electronic Invoicing
Upon successful payment, an electronic invoice is issued. The following data is transmitted to KBOSS.hu Kft. (Számlázz.hu):
- Billing name and address
- E-mail address (for invoice delivery)
- Tax number / EU VAT number (if business invoicing)
- Purchase details (service name, quantity, unit price, VAT, total)
Legal basis: GDPR Art. 6(1)(b) (contract) and Art. 6(1)(c) (legal obligation – Hungarian Accounting Act §§ 167–169, VAT Act §§ 163–165).
2.8. Photos and Videos at Tournaments
At tournaments and events organised by us, photo, audio and video recordings may be made and used for reporting, sports documentation and club promotion (website, social media).
- Data processed: photos/videos; occasionally names of winners and prize-winners
- Legal basis: GDPR Art. 6(1)(f) – legitimate interest (sports communication); Ptk. § 2:48(2) for crowd shots
- Retention: archive; individual recordings removed upon request
- Your rights: right to object – inform staff on-site or e-mail szigligettenisz@gmail.com
Names of prize-winners are published only after obtaining separate consent during the entry process.
2.9. Automated Decision-Making
No automated decision-making or profiling under GDPR Art. 22 takes place.
3. Automated E-mails
- E-mail address verification (after registration)
- Password reset link (upon request)
- Court booking confirmation
- Club membership confirmation
- Booking cancellation link (in the confirmation e-mail)
We do not send newsletters, advertisements or marketing messages.
4. Data Processors and Recipients
| Processor | Activity | Location | Company Reg. |
|---|---|---|---|
| Barion Payment Zrt. | Online bank card payment processing | 1117 Budapest, Infopark sétány 1. | 01-10-048552 |
| KBOSS.hu Kft. (Számlázz.hu) | Electronic invoice generation and delivery | 1031 Budapest, Záhony u. 7. | 01-09-303201 |
| Rackhost Zrt. | Web server, database and e-mail hosting | 6722 Szeged, Tisza Lajos krt. 41. | 06-10-000489 |
No personal data is transferred to third countries (outside the EU/EEA).
5. Retention Periods
| Data category | Retention period |
|---|---|
| User account data | Until deletion; personal identifiers immediately anonymised on deletion |
| Booking and payment records | 8 years (VAT Act § 169) |
| Rate limiting logs (IP address) | Login: max. 15 min; registration/password reset: max. 1 hour |
| Session cookie | Until the browser is closed |
| "Remember me" cookie | 30 days (if selected) |
| E-mail verification and password reset tokens | Invalidated after use or after 1-hour expiry |
6. Cookies
6.1. Essential Cookies (no consent required)
- Session cookie – required for login state and CSRF protection. Deleted automatically when the browser is closed. Legal basis: ePrivacy Directive Art. 5(3) exception; GDPR Recital 30.
- "Remember me" cookie – only set when the user explicitly ticks "Remember me (30 days)" at login. The active tick constitutes consent.
6.2. Marketing and Conversion Tracking Cookies (consent required)
- Barion Pixel – a conversion tracking and remarketing tool by Barion Payment Zrt. Purpose: measuring payment conversions and supporting remarketing campaigns. The Barion Pixel is only activated after you click "Accept" in the cookie banner; it is never loaded if consent is not given. Barion privacy policy: barion.com/en/privacy-policy. Legal basis: GDPR Art. 6(1)(a) – consent.
Cookie consent may be withdrawn at any time by clearing cookies in your browser settings. Withdrawal does not affect the lawfulness of prior processing.
The website does not use analytical, social media or other advertising cookies.
7. Security Measures
- Passwords stored exclusively as bcrypt hashes (min. 10 characters, digit and letter required)
- CSRF protection on all data-modifying operations
- Rate limiting on login, registration and password reset
- Session ID regeneration on login (protection against session fixation)
- Timing-attack protection in the login process
- HTTPS communication on the live server
8. Your Rights
- Right of access (Art. 15) – you may request information about the data we hold
- Right to rectification (Art. 16) – you may request correction of inaccurate data
- Right to erasure / "right to be forgotten" (Art. 17) – you may request deletion; you can also delete your account on the My Profile page. Invoicing records are retained for 8 years due to legal obligations.
- Right to restriction of processing (Art. 18) – you may request suspension of processing in certain circumstances
- Right to data portability (Art. 20) – you may request your data in a machine-readable format (for consent- or contract-based automated processing)
- Right to object (Art. 21) – you may object to processing based on legitimate interest
- Right to withdraw consent (Art. 7(3)) – consent may be withdrawn at any time free of charge; withdrawal does not affect prior processing
Submit requests to szigligettenisz@gmail.com or call +36-20-331-1630. We will respond within 30 days (may be extended by 2 months where justified, with notice).
9. Right to Lodge a Complaint
If you believe our processing infringes the GDPR, you may lodge a complaint with:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Address: Falk Miksa utca 9–11., 1055 Budapest, Hungary
Postal address: Pf. 9., 1363 Budapest
E-mail: ugyfelszolgalat@naih.hu
Web: https://naih.hu
You may also bring a legal action before a competent Hungarian court.
10. Changes to This Policy
We reserve the right to amend this policy. In the event of material changes, we will publish a notice on the website and notify registered users by e-mail where necessary. The current version is always available at www.szigliget-tennis.hu.