Effective from: 9 August 2026
The purpose of this Privacy Policy is to ensure that visitors to the website operated by COSY MOSSY at "https://cosymossy.hu" and guests who book accommodation through the website are properly informed about how their personal data is processed.
The data controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR), as well as applicable Hungarian laws and regulations.
1. DATA CONTROLLER DETAILS
Name of the Data Controller: COSY MOSSY Kft.
Adress: 9700, Szombathely, Határőr utca 38.
Email: info@cosymossy.hu
Telephone: +36705926166
Webpage: https://cosymossy.hu
Questions, requests, and inquiries regarding the processing of personal data may be submitted to the data controller using the contact details provided above.
The data controller does not appoint a Data Protection Officer unless required to do so by applicable law.
2. PURPOSE OF DATA PROCESSING
The data controller processes personal data provided through the website for the following purposes:
– Receiving and recording accommodation bookings;
– Confirmation of bookings;
– Communication regarding bookings;
– Responding to guests’ questions and requests;
– Communication relating to the provision of accommodation services;
– Handling booking changes or cancellations;
– Compliance with legal obligations;
– Fulfilment of accounting and tax obligations;
– Establishing, pursuing, or defending against potential legal claims;
– Ensuring the secure and proper functioning of the website;
– Analysis of the website’s technical functionality and performance;
The data controller processes only the personal data necessary to achieve the specific purpose.
3. PERSONAL DATA PROCESSED THROUGH THE BOOKING FORM
When completing the booking form on the website, the data controller collects the following personal data:
| Data Processed | Purpose of Data Processing |
| Name | Identification of the Person Making the Booking and Booking Management |
| Booking Confirmation and Electronic Communication | |
| Telephone | Communication and, Where Necessary, Coordination Regarding the Booking |
| Adress | Required for Issuing the Invoice Related to the Booking |
Providing the above information is necessary to process the booking.
The data controller does not request any special categories of personal data through the booking form.
We kindly ask visitors not to provide health-related, religious, political, or other special categories of personal data in the booking form.
4. LEGAL BASIS FOR THE PROCESSING OF BOOKING DATA
The processing of personal data provided through the booking form is primarily based on:
It is based on Article 6(1)(b) of the GDPR, meaning that the processing is necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract.
For data provided before a booking is made, processing may also be necessary to take steps at the data subject’s request prior to entering into a contract.
Where the processing of certain data is necessary to comply with a legal obligation, the legal basis is Article 6(1)(c) of the GDPR.
Where the processing of personal data is necessary to establish, pursue, or defend against legal claims, the legal basis is Article 6(1)(f) of the GDPR, namely the legitimate interests of the data controller.
5. RETENTION PERIOD FOR BOOKING DATA
The data controller processes the personal data provided through the booking form for as long as necessary to manage the booking and provide the accommodation services.
After the booking has been completed, the data controller retains the data only if:
– Compliance with a legal obligation;
– Fulfilment of accounting or tax obligations;
– Establishing, pursuing, or defending against legal claims;
– Or another lawful purpose for data processing.
is necessary.
The data controller retains data that must be kept by law for the period specified in the applicable legislation.
If there is no lawful basis for retaining the data any longer, the data controller will delete or anonymise them.
6. THE BOOKING SYSTEM – BOOKING CALENDAR WP
The Booking Calendar WP plugin is used on the website to manage accommodation bookings.
When creating and managing a booking, the booking system processes the information provided by the person making the booking, including in particular:
- Name
- Telephone
- Adress
may process.
The purpose of the booking system is to display available dates, record bookings, manage booking data, and facilitate communication related to bookings.
The data controller has access to the data stored in the booking system. Hosting and technical service providers may also access these data to the extent necessary to provide their services.
7. GRAVITY FORMS
A weboldalon található űrlapok működtetéséhez a Gravity Forms bővítmény kerül alkalmazásra.
Gravity Forms transmits and processes the information provided by visitors when submitting forms, in accordance with the purpose and functionality of each form.
If a form is used for booking purposes, the processing of the personal data provided through that form is necessary to complete the booking.
8. ELEMENTOR PRO
The Elementor Pro plugin is used to design and display the website.
Elementor Pro primarily ensures the technical functionality and visual presentation of the website.
The use of Elementor Pro does not in itself constitute a separate purpose for data processing. However, the operation of the website may require the processing of technical data.
9. EMAIL DELIVERY AND GOSMTP PRO
The GoSMTP Pro plugin is used for the technical transmission of email messages sent from the website.
The service may be used to transmit, among other things:
– Confirmation of bookings;
– Booking-related notifications;
– Other electronic communications between the data controller and the guest.
The technical provider of the email service may access personal data transmitted by email to the extent necessary to provide the service.
Email service providers: Google Workspace; Sybell Informatika Kft. (as the hosting provider).
The email service provider may also process personal data in accordance with the data processing practices set out in its own privacy policy.
10. GOOGLE SITE KIT
Google Site Kit is used to monitor the technical and statistical performance of the website.
Google Site Kit enables the website operator to view data from various Google services.
When using Site Kit, the website operator primarily receives aggregated technical and statistical information about the website’s performance.
If a Google service that processes personal data or online identifiers is enabled through Site Kit, the data processing activities of that service are also subject to its own privacy policies.
11. GOOGLE SEARCH CONSOLE
Google Search Console is used to monitor the website’s appearance in search engine results, indexing status, and technical performance.
Google Search Console enables the data controller to obtain information about, among other things:
– The website’s appearance in Google Search results;
– Search performance;
– The technical status of the website;
– Indexing issues;
– Search queries and their performance.
The primary purpose of using Search Console is to manage and technically optimize the website. It is not intended to create profiles based on the name, telephone number, or email address provided through the booking form.
The use of Google Search Console is also subject to Google's applicable privacy policy and terms of service.
12. GOOGLE ANALYTICS
If Google Analytics 4 is also enabled on the website through Google Site Kit, its purpose is to provide statistical analysis of website traffic and usage.
When using Google Analytics, various technical data and online identifiers may be processed.
Non-essential statistical cookies and similar technologies may only be used with the visitor’s valid consent.
13. COOKIEADMIN PRO AND COOKIES
The website may use cookies and similar technologies.
Some cookies are necessary for the basic functioning of the website, while others may be used for statistical, analytical, or other purposes.
The CookieAdmin Pro plugin is used to manage cookies.
Strictly necessary cookies are required for the website to function properly.
Where non-essential cookies, such as those used for statistical or marketing purposes, are used, the website may request the visitor’s consent.
The specific cookies used on the website, their purposes, providers, and retention periods are detailed in the separate Cookie Policy.
14. RANK MATH SEO PRO
The Rank Math SEO Pro plugin is used to optimise the website for search engines.
The purpose of the plugin is to support the technical optimisation of the website for search engines.
Rank Math SEO Pro primarily provides technical and search engine optimisation features.
15. WP ROCKET
The WP Rocket plugin is used to optimise the website’s performance and loading speed.
WP Rocket primarily provides caching, performance optimisation, and technical functionality.
The plugin is intended to ensure faster and more efficient website performance.
16. WEB HOSTING PROVIDER
The hosting services for the website and its associated database are provided by the following service provider:
Hosting Provider Name: Sybell Informatika Kft.
Registered Office: 1138 Budapest, Tomori u. 34, Hungary
Website: http://www.sybell.hu
The hosting provider may access the data stored on its servers to the extent necessary to provide the services required for the operation of the website and its database.
17. DATA PROCESSORS
The data controller uses technical service providers to operate the website and accommodation.
Data processors may process personal data only on the instructions of the data controller and to the extent necessary to provide the services specified for them.
The data controller endeavours to engage service providers that implement appropriate technical and organisational measures.
Data processors may include, in particular, the following service providers:
– Hosting provider;
– Technical provider of the booking system;
– Email delivery service provider;
– Technical service providers involved in the operation of the website;
– Google services, where their use involves the processing of personal data.
The current list of specific service providers and data processors is available from the data controller.
18. DATA TRANSFERS TO THIRD COUNTRIES
Some of the service providers used for the operation of the website are based outside the European Economic Area (EEA), or use infrastructure that may also be located outside the EEA.
Where personal data is transferred to a country outside the European Economic Area (EEA), the data controller shall carry out such transfers only if the conditions laid down in the GDPR are met.
Such data transfers may take place on the basis of appropriate safeguards, in particular an adequacy decision adopted by the European Commission or other appropriate safeguards recognized under the GDPR.
19. DATA SECURITY
The data controller takes appropriate technical and organizational measures to ensure the security of personal data.
In this context, the data controller strives in particular to:
– prevent unauthorized access;
– prevent unauthorized alteration of personal data;
– prevent the loss or unauthorized destruction of data;
– ensure the secure operation of the website and the database;
– properly manage access permissions;
– apply necessary security and technical updates.
In the event of a personal data breach, the data controller shall act in accordance with the relevant provisions of the GDPR.
20. RIGHTS OF DATA SUBJECTS
The data subject has the following rights in relation to the processing of their personal data.
20.1. Right to Information and Access
The data subject has the right to request information as to whether the data controller processes their personal data and, if so, which data are processed, for what purposes and on what legal basis.
20.2. Right to Rectification
The data subject may request the rectification of inaccurate personal data and the completion of incomplete data.
20.3. Right to Erasure
The data subject may request the erasure of their personal data under certain conditions.
The right to erasure does not apply where the data controller is legally required to retain the data or where the processing of such data is necessary for other lawful reasons.
20.4. Right to Restriction of Processing
The data subject may request the restriction of the processing of their personal data in certain cases.
20.5. Right to Object
Where the processing is based on the legitimate interests of the data controller, the data subject has the right to object to the processing in accordance with the conditions set out in the GDPR.
20.6. Right to Data Portability
Where the conditions set out in the GDPR are met, the data subject has the right to receive the personal data they have provided to the data controller in a machine-readable format or to have those data transmitted to another data controller.
20.7. Right to Withdraw Consent
Where the legal basis for processing is the data subject’s consent, the data subject may withdraw their consent at any time.
The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.
22. COMPLAINTS AND LEGAL REMEDIES
If the data subject considers that the processing of their personal data infringes the provisions of the GDPR, they have the right to lodge a complaint with the competent data protection supervisory authority.
The competent supervisory authority in Hungary is:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Registered office: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, P.O. Box 9, Hungary
E-mail: ugyfelszolgalat@naih.hu
Website: https://www.naih.hu
The data subject also has the right to seek judicial remedy in accordance with the applicable legal provisions.
According to the NAIH's own information, the data subject may also initiate a data protection supervisory procedure.
23. AUTOMATED DECISION-MAKING AND PROFILING
The data controller does not use automated decision-making based on the personal data provided in the booking form that produces legal effects concerning the data subject or similarly significantly affects them.
The data controller does not carry out profiling for such purposes based on the personal data of individuals making a booking.
24. THIRD-PARTY PERSONAL DATA
If the person making the booking provides the data controller with personal data of other individuals, such as travel companions or additional guests, the person making the booking is responsible for ensuring that those individuals are adequately informed about the processing of their personal data.
The data controller processes only those data that are necessary for the provision of the service or for the fulfilment of its legal obligations.
25. LEGALLY REQUIRED DATA PROCESSING RELATED TO ACCOMMODATION SERVICES
In the course of providing accommodation services, the data controller may be subject to additional data processing and data reporting obligations under the laws and regulations applicable to accommodation providers.
These data processing activities are not necessarily identical to the data processing carried out through the booking form available on the website.
Where required by law, the data controller processes personal data for the identification, registration or reporting of guests, or for the provision of data to an authority or government system, in accordance with the applicable legal provisions.
26. DATA RELATED TO THE TECHNICAL OPERATION OF THE WEBSITE
When visiting the website, certain data may be automatically recorded for technical reasons, such as:
– IP address;
– Date and time;
– Page visited;
– Browser type used;
– Operating system;
– Technical data related to the use of the website.
These data are primarily used to ensure the secure and proper operation of the website and to identify and resolve any potential technical errors.
The legal basis for processing such data may be the data controller’s legitimate interest pursuant to Article 6(1)(f) of the GDPR, insofar as the processing is necessary for the secure and proper operation of the website.
27. AMENDMENTS TO THE PRIVACY POLICY
The data controller reserves the right to amend this Privacy Policy to ensure that it complies with the applicable legislation in force at any given time, as well as with any changes to the operation of the website and the accommodation.
The current version of the Privacy Policy is available on the website.
Effective date of this Privacy Policy: 9 August 2026.
Data Controller: COSY MOSSY Kft.
E-mail: info@cosymossy.hu
Telephone: +36705926166
Address: 9700 Szombathely, Határőr utca 38., Hungary
Website: https://cosymossy.hu
Hungarian Hungarian 
German
English
