This notice describes how we process personal data in connection with the website, bookings and your stay. The general rules are set out in the data protection policy of Napkirály Kft. (in Hungarian).
Data controller
Napkirály Kft.
Registered office: Esztergár Lajos utca 5/a, 3rd floor, door 2, 7633 Pécs, Hungary
Company registration number: 02-09-087372 · Tax number: 32182402-2-02
Accommodation: Király utca 23-25, 7621 Pécs, Hungary
NTAK registration: KO23056234 (Hostel), EG23055786 (NAPartman)
Contact: info@naphostel.com · +36 30 252 2972
What data we process
During the booking process we ask for and process the following personal data:
- Data needed for the booking: name, email, phone number, arrival and departure dates, number of guests, room type
- At check-in: details from a valid identity document (name, date of birth, nationality, address, document number), which Hungarian law requires us to record (NTAK)
- For invoicing the tourist tax: name and address (if different from the person who booked)
- Messages you choose to send us (through the forms)
Why we process it
- To fulfil your booking (contract)
- To comply with Hungarian tourism and accommodation laws (legal obligation: reporting to NTAK)
- To issue invoices and receipts
- To keep in touch with you (confirmation, arrival information)
How long we keep it
- Booking data: 5 years after the stay (accounting retention period)
- Data required by NTAK: for the period required by law
- Requests and messages sent through the website: until we have answered them; if you then book, they are kept together with the booking data
Who we share it with
Your data is confidential. We only pass it on to third parties in the following cases:
- The NTAK system (mandatory reporting)
- Our booking engine provider (eZee Reservation / iPMS247), as a contracted data processor
- Our email providers: Google (our mailbox) and Resend (sending the emails from the website forms)
- Our hosting provider: Cloudflare (serving the website and bot protection)
- The providers of the website chat assistant: Anthropic (generating the replies), Vercel (hosting) and Supabase (storing the conversations)
- Our accountant
- Authorities (where required by law)
Forms on the website
We use the data you enter in the booking form and the contact form (name, email address, phone number, postcode and town, dates, check-in time, number of guests, number of guests under 18, type of stay, group details if you are booking for a group, and your message) to confirm your booking, reply to you and send you an offer. Forms reach us by email, and we keep them together with the booking data. Legal basis: steps taken at your request before entering into a contract. When you send a form, you will receive an automatic confirmation email.
The booking form is protected against bots by Cloudflare Turnstile. To run this check, Cloudflare processes some technical data, such as your IP address and browser type, when you open and send the form. We use this data only for the check. Legal basis: our legitimate interest in filtering out fake, automated bookings.
The website chat assistant
On the website, the Reception AI assistant answers your questions. What you type is processed by an artificial intelligence model (Claude, made by Anthropic) so that it can reply. We save the text, language and time of the conversation, as well as your browser type, the page on which you used the chat and an irreversible hash of your IP address (to limit misuse), so that we can see where the assistant could not help and improve its answers. If you give your email address so that our reception can reply to you personally, we forward your question and a summary of the conversation to info@naphostel.com.
Please do not type identity document or bank card details into the chat. Legal basis: steps taken at your request before entering into a contract (answering your question), and our legitimate interest in improving the service. We keep conversations for no more than 6 months and then delete them.
The chat providers are Anthropic (generating the replies), Vercel (hosting), Supabase (storing the conversations) and Resend (delivering emails). Several of them operate in the United States. We transfer data to them with the safeguards required by Chapter V of the GDPR.
CCTV
For security reasons, 2 cameras operate in the shared areas of the accommodation. There are no cameras in the toilets, the shared kitchens or the rooms. We keep the recordings for 3 days and then delete them, unless an incident has to be investigated or an authority requests them. Legal basis: our legitimate interest in protecting guests and property. If you think you have been recorded, you can ask to see the footage in which you appear, or ask us not to delete it while your case is being dealt with.
Your rights (GDPR)
- Access to the data we hold about you
- Rectification (if it is inaccurate)
- Erasure (subject to the retention periods required by law)
- Restriction of processing
- Data portability
- Objection
- Lodging a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
To exercise any of your rights, write to info@naphostel.com, or contact us by post or in person at our registered office. We will look into your request and tell you the outcome within 30 days.
You can also complain to the NAIH: Falk Miksa utca 9-11, 1055 Budapest, Hungary; postal address: 1363 Budapest, Pf. 9.; phone: +36 1 391 1400; email: ugyfelszolgalat@naih.hu; website: naih.hu. You can also go to court: you may bring the case before the regional court for the place where you live or are staying.
Cookies
The website uses no cookies of its own. We measure visits with a cookie-free tool (Cloudflare Web Analytics), which does not store IP addresses and does not identify you. We count clicks on buttons anonymously and in aggregate. There is no Google Analytics, Facebook pixel or similar tracking code on the website. If you send a message in the chat, the chat assistant stores a random conversation ID in your browser's local storage so that the conversation can continue. Until you do, it stores nothing.
When the Google map embedded on the Contact page loads, Google (Google Ireland Limited) may set cookies in your browser and receives your IP address. That is why we only load the map with your consent (legal basis: consent), which you can give in the bar shown on your first visit or with the button in place of the map. We remember your choice in your browser's local storage, and you can change it at any time with the “Cookie settings” link in the footer. How Google processes data: policies.google.com/privacy.