Privacy Policy | Elf Garden

Effective: 22 September 2026

1. Purpose of this policy

The purpose of this policy is to explain what personal data Elf Garden processes during its service, for what purpose, on what legal basis, and for how long.

This policy is based on Regulation (EU) 2016/679 (GDPR) and the relevant Hungarian laws. The Controller processes personal data confidentially, securely and in compliance with the applicable laws, and does not sell it.

2. Details of the controller

Controller: Papp Gergely, private individual with a tax number (Elf Garden)
Seat / mailing address: 2092 Budakeszi, Viktória utca 21., Hungary
Tax number: 59342386-1-33
E-mail: info@elf.hu
Phone: +36 30 267 5680

3. Data processing related to booking

Stay booking data is processed by Beds24, Airbnb or Booking.com - depending on where the booking is made. For garden and custom requests, and for contact, the Controller processes name, e-mail address, phone number, requested times and guest count.

Purpose: handling the booking, keeping in contact, providing the service, invoicing, handling any complaints
Legal basis: performance of a contract and compliance with a legal obligation

4. NTAK data reporting and handling of documents

This section applies only to the accommodation service; no ID document is required for garden hire.

The accommodation provider is required by law to transfer certain guest data to the National Tourism Data Supply Centre (NTAK). For this, after the booking is confirmed, the Guest sends electronically the data from their ID card or passport and their address card.

Data processed includes in particular: name, birth data, nationality, ID document data, address data. The Controller processes these solely for the statutory guest identification, NTAK reporting and provision of the service, and treats them confidentially.

Purpose: fulfilling the statutory data reporting obligation, guest identification
Legal basis: compliance with a legal obligation

5. Data processing related to payment

This website does not process card payments and does not handle card data. On the website, the stay is paid by card in Beds24 via Stripe. Airbnb or Booking.com bookings use those platforms’ payment systems.

For garden and custom requests the fee is paid by bank transfer; billing data is processed via Számlázz.hu.

Purpose: invoicing garden and custom requests, identifying bank transfers
Legal basis: performance of a contract and compliance with a legal obligation

6. Data processing related to invoicing

The Provider uses the Számlázz.hu electronic invoicing service to issue invoices. The data processed: name, billing address, tax number (where relevant), and data on the value of the service.

Purpose: issuing invoices, fulfilling accounting obligations, retaining records
Legal basis: compliance with a legal obligation

7. Contact

When contacted via the website contact form, the garden/custom request form, or by e-mail or phone, the Controller processes the data provided by the Guest (name, e-mail address, phone number, message content, requested dates and guest count) solely to answer the enquiry, assess the request and to keep in contact.

Purpose: answering the enquiry, keeping in contact
Legal basis: the data subject's consent, or steps taken prior to entering into a contract

8. Data processing related to the website's operation

The website runs on WordPress with the Polylang plugin, and uses technical (functional / necessary) cookies for proper operation, e.g. to remember the session, the language setting and the stay booking calendar (Beds24). The Controller uses a hosting provider (Websupport Magyarország Kft.) to operate the website.

The website may embed a Google Maps map and YouTube videos; these fall under the marketing category and load only after the visitor’s consent.

The website also uses a Google Analytics tag and a Meta Pixel (Facebook / Instagram). Google Analytics falls under the statistics category, and the Meta Pixel under the marketing category. Both load only after the visitor’s prior consent. If the visitor refuses the category, or later withdraws consent, that code does not run. Details of cookie categories and consent handling are provided in the Cookie Policy.

9. Processors and data transfers

The Controller transfers personal data to the following recipients. Transfers needed for booking, invoicing and operating the website are tied to providing the service or to a legal obligation. Transfers for statistics and marketing take place only after the visitor’s prior consent.

National Tourism Data Supply Centre (NTAK): fulfilling the statutory data reporting obligation
Beds24: stay booking calendar on the Booking page
Stripe: card payment for website stays, via Beds24
Airbnb / Booking.com: if the Guest books the stay on that platform
Számlázz.hu (KBOSS.hu Kft.): issuing invoices, accounting obligations
Websupport Magyarország Kft.: technical provision of the website and hosting
Google Ireland Limited: Google Analytics audience measurement (after statistics consent) and the embedded Google Maps map (after marketing consent)
YouTube: displaying embedded videos (after marketing consent)
Meta Platforms Ireland Limited: Meta Pixel to measure Facebook and Instagram ads (after marketing consent)

Without consent, Google Analytics and the Meta Pixel receive no data about the visit. Google and Meta may process the data they receive outside the European Economic Area, including in the United States; their own notices apply.

The Controller does not sell personal data and does not build a commercial database from it.

10. Data retention periods

The Controller processes personal data only for as long as necessary to achieve the purpose of processing or to fulfil a legal obligation:

Billing data: minimum 8 years (under the Accounting Act)
Booking data: until the service is completed, then until any legal claims lapse (5 years)
Document copies (accommodation): for 30 days after departure, then deleted
Contact data: until the matter is resolved or the data subject requests deletion
Website statistics and marketing: on the website until consent is withdrawn; at Google and Meta, for the retention period set by that provider

11. Data security

The Controller protects personal data with appropriate technical and organisational measures against unauthorised access, alteration, transfer, disclosure or deletion. This includes restricting access to electronic systems, regulating access to data on the basis of authorisation, and carefully selecting external providers.

There is no camera surveillance system on the Elf Garden premises.

12. Rights of the data subject

In relation to the processing of their personal data, the Guest has the following rights:

right to information and access - to learn what data the Controller processes, for what purpose, and to whom it is transferred;
right to rectification - to request correction of inaccurate or incomplete data;
right to erasure - to request deletion of data where there is no legal obstacle;
right to restriction of processing;
right to object;
right to data portability - where the conditions are met.

13. Remedies

The Guest may submit a data protection request at info@elf.hu or by phone at +36 30 267 5680. The Controller will investigate the request without undue delay and respond within the statutory deadline.

If the Guest considers that their rights have been infringed during the processing of their data, they may lodge a complaint with the supervisory authority or turn to a court. The Hungarian data protection supervisory authority:

Authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Mailing address: 1363 Budapest, Pf. 9., Hungary
E-mail: ugyfelszolgalat@naih.gov.hu
Phone: +36 1 391 1400
Website: naih.hu

14. Closing provisions

The Controller reserves the right to amend this policy, in particular in case of legislative changes or technical changes to the services. Amendments take effect upon publication on www.elf.hu.

Effective date: 22 September 2026.

Elf Garden · Papp Gergely, Controller