DATA PROCESSING INFORMATION

Thursday, 17 September 2026 08:31

MIDMAR Nonprofit Ltd.

In accordance with Articles 13-14 of the General Data Protection Regulation (GDPR) of the European Parliament and Council (EU) 2016/679, we would like to inform you about certain features of data processing carried out by our company.

The data controller

Name:

MIDMAR Miskolc Tourism Marketing Nonprofit Public Benefit Ltd.

Email:

info@visitmiskolc.hu

Phone:

+36 46 350 425

Headquarters:

3530 Miskolc, Széchenyi Street 16.

Company registration number:

05-09-024717

Tax number:

24113917-2-05

A(hereinafter referred to as MIDMAR or data controller)

Our data protection officer's contact details: Dr. Eszter Csillag, gdpr@miskolc.hu; eszter@powersec.hu, +36 20A822 7008.
The data controller processes the personal data of the data subject for the purposes defined in this notice and to the extent necessary to achieve these purposes. In connection with data processing, the personal data of the data subject may be accessed by authorised employees of the data controller. Only those employees whose job responsibilities involve handling specific personal data are authorised to access them. The data controller does not make decisions based on automated data processing or carry out profiling.
If data processing is carried out via our websites (https://www.visitmiskolc.hu/ or https://www.miskolcpass.com/), by using the website, you accept the terms outlined in this privacy notice. If you do not accept the terms of the privacy notice, please refrain from using the website. Additional information regarding data processing related to cookies used on the website can be found in the online platform data processing information (miskolcpass.com / www.visitmiskolc.hu).
The following important information applies to data processing:

A) Miskolc Pass Classic card

Data subjects

Holders of the Miskolc Pass Classic card

Purpose of data processing

Operation of the card system, identification of cardholders, management of discounts

Scope of data processed

Data required for identification (name, birth name, residence, postal address, ID card number, place and date of birth, mother's full birth name)

Legal basis for data processing

Performance of a contract

Duration of data processing

Data processing lasts for three years following the expiration of the Miskolc Pass Classic card's validity

Mandatory or voluntary nature of data provision

You are not obliged to provide your data; however, we can only issue the Miskolc Pass Classic card if you consent to the processing of your personal data.

Data transfer

Miskolc Holding Zrt., Municipality of Miskolc City with County Rights, for supervisory purposes, on the www.visitmiskolc.hu, www.miskolcpass.hu websites, and to the acceptance points listed in Annex 1 of this notice, for the purpose of verifying the card's validity.

Data processors

Qilaq Solutions Ltd. (8623 Balatonföldvár, Móricz Zsigmond Street 26. Building B, data processing activity: operation of the card system), Miskolc Holding Zrt. (3530 Miskolc, Petőfi Street 1-3., data processing activity: IT security backups of the data controller's system), MVK Zrt. (3527 Miskolc, Szondi György Street 1., data processing activity: verification of eligibility for public transport use with the card)

B) Miskolc Pass tourist card

Data subjects

Holders of the Miskolc Pass tourist card

Purpose of data processing

Operation of the card system, identification of cardholders, management of discounts

Scope of data processed

Data required for identification (name, date of birth)

Legal basis for data processing

Performance of a contract

Duration of data processing

Data processing lasts for three years following the expiration of the Miskolc Pass tourist card's validity

Mandatory or voluntary nature of data provision

You are not obliged to provide your data. However, if you do not provide your data, we cannot issue the Miskolc Pass tourist card.

Data transfer

Data processors

ELECTRONIC DELIVERY OF THE MISKOLC PASS CLASSIC AND TOURIST CARDS

Data subjects

Holders of the Miskolc Pass Classic and Miskolc Pass tourist cards

Purpose of data processing

Electronic delivery of the discount card

Scope of data processed

Data required for electronic delivery (email address)

Legal basis for data processing

The data subject's consent

Duration of data processing

The email address is processed until the email is sent for electronic delivery purposes

Mandatory or voluntary nature of data provision

You are not obliged to provide your data. However, without your data, we cannot electronically deliver the Miskolc Pass Classic / Miskolc Pass tourist card.

Data processors

NEWSLETTER DELIVERY

Data subjects

Individuals who have consented to receiving newsletters from MIDMAR

Purpose of data processing

Providing information about MIDMAR's tourism-related programmes and events, as well as tourism opportunities and programmes offered by companies associated with the data controller through MIDMAR Ltd.

Scope of data processed

Contact details required for communication (name, email address)

Legal basis for data processing

The data subject's consent

Duration of data processing

Until the consent is withdrawn. Consent can be withdrawn by sending an email to the data controller's electronic contact (info@visitmiskolc.hu) or by sending a letter requesting unsubscription to 3525 Miskolc, Városház Square 8.

Mandatory or voluntary nature of data provision

You are not obliged to provide your data. However, we can only provide information if you provide your data and consent to data processing.

Data processors

Miskolc Holding Zrt. (3530 Miskolc, Petőfi Street 1-3., data processing activity: IT security backups of the data controller's system), Mimézis Ltd. (8600 Siófok, Kristály Street 12., data processing activity: operation of the newsletter management platform)

DATA PROCESSING RELATED TO INVOICING

Data subjects

Natural persons contracting with the data controller

Purpose of data processing

Recording invoicing data based on the contract between the data controller and the data subject

Scope of data processed

Data required for identification (name, address, email address, phone number)

Legal basis for data processing

Compliance with legal obligations regarding the issuance and retention of accounting documents

Duration of data processing

8 years following the termination of the contract, based on the retention obligation for accounting documents.

Mandatory or voluntary nature of data provision

Providing personal data necessary for identification, as well as your tax-related identification number, is a prerequisite for concluding the contract and is required by law. Without providing your data, we cannot enter into a contract with you.

DECLARATION REGARDING LOST CARDS

Data subjects

Natural persons contracting with the data controller regarding the Miskolc Pass Classic or Miskolc Pass tourist card

Purpose of data processing

Invalidation of the lost card, issuance of a new card

Scope of data processed

Data required for identification (name, date of birth, address, mother's name, signature)

Legal basis for data processing

Performance of the contract related to the card between the data controller and the data subject

Duration of data processing

1 year following the card cancellation based on the declaration

Mandatory or voluntary nature of data provision

Providing data is voluntary, but without the declaration, we cannot issue a new card.

PHOTO/VIDEO/AUDIO RECORDING AND USAGE AT EVENTS

Data subjects

Individuals appearing in photos and potential video recordings taken at events organised by the data controller or invited press outlets.

Purpose of data processing

§A Promotion of the data controller's events, marketing communication purposes

§A Informing the public about the event

§A Informing the press, press usage

Scope of data processed

Image, audio, other personal data appearing in recordings. In case of written consent, the name, address, and signature of the data subject.

Legal basis for data processing

We inform visitors to events organised by MIDMAR that participants consent to the taking of photos, video recordings, and audio recordings at the events by MIDMAR and/or various press outlets, as well as to their publication and transmission to the press for usage.

Accordingly, the legal basis for data processing related to the recordings is:

§A The data subject's consent, which may be given through implied conduct (such as entering a room where the data subject knows recordings are being made or may be made) or explicit declaration.

§A Consent is not required for the taking and use of photos and video recordings in the case of mass recordings and public appearances.

Duration of data processing

Data processing lasts until the data subject's request for deletion is fulfilled or the data is deleted following the data subject's objection.

Mandatory or voluntary nature of data provision

You are not obliged to consent to the taking and use of photos and video recordings. However, in this case, you may not be able to participate in certain events. You can object to the use of already taken photos or video recordings or request their deletion from the data controller at any time.

Data transfer

Recordings may be transferred to press representatives. Individual press outlets may use the recordings for mass communication purposes in compliance with the provisions of Act CLXXXV of 2010 on Media Services and Mass Communication, as well as Act CIV of 2010 on the Freedom of the Press and the Basic Rules of Media Content. Upon request, the data controller will provide information about which press outlets received recordings of which events.

We draw attention to the fact that press representatives may also directly take photos, video recordings, and audio recordings at events.

DATA PROCESSING RELATED TO BUSINESS CONTACTS OF COMPANIES CONTRACTING WITH THE DATA CONTROLLER

Data subjects

Employees of third parties contracting with the data controller, or individuals in other employment relationships with them, who act as contacts in fulfilling the contract

Purpose of data processing

§A Ensuring smooth and seamless communication during contractual relationships through contacts, which requires the data controller to know the contact details.

§A Direct business acquisition targeting the company as the recipient of advertising, provided the data subject does not object to data processing.

Scope of data processed

Contact details required for communication (name, email address, phone number, related company/institution name, and possibly position)

Source of data

Directly from the data subject or the company contracting with the data controller

Legal basis for data processing

The legal basis for data processing is the legitimate interest of the data controller. Legitimate interest includes (i) ensuring communication necessary for fulfilling contracts with third parties, and (ii) direct business acquisition for business-related (not addressed to natural persons) offers or advertisements (Recital 47 of the GDPR). The data controller ensures the possibility of objection (unsubscription), so if the data subject declares that they do not wish to receive advertising-related communications from the data controller, their data will be deleted and not used for this purpose.

Duration of data processing

§A Maintaining a record of contact details, offers, and other written and email communication: 5 years from the termination of the contract

§A Contracts, orders, and invoices, if they contain the data subject's information: 8 years from the termination of the contract, based on the retention obligation for accounting documents.

§A In the case of direct business acquisition, data processing lasts until the data subject objects.

Mandatory or voluntary nature of data provision

You are generally not required to provide your personal data to us. However, if you are a contact person, the processing of your data is necessary for fulfilling the contract, and without it, the contract may face obstacles, potentially leading to its termination.

COMPLAINT HANDLING

Data subjects

Customers submitting complaints

Purpose of data processing

Filling out a complaint record, maintaining contact with the complainant, investigating the complaint

Scope of data processed

Data required by law for handling complaints (complainant's name, postal address, email address, signature)

Legal basis for data processing

§A Compliance with legal obligations under Section 17/A (5) of Act CLV of 1997 on Consumer Protection

§A The legal basis for processing the complainant's email address is the complainant's consent

Duration of data processing

§A 5 years, based on Section 17/A (7) of Act CLV of 1997 on Consumer Protection

§A Processing of email address data lasts until consent is withdrawn, but no longer than 5 years

Mandatory or voluntary nature of data provision

In the case of a complaint, you are legally required to provide your data to ensure effective investigation of the complaint.

Data processors

Miskolc Holding Zrt. (3530 Miskolc, Petőfi Street 1-3., data processing activity: IT security backups of the data controller's system)

DATA PROCESSING FOR INDIVIDUALS SUBMITTING JOB APPLICATIONS TO MIDMAR

Data subjects

Individuals applying for a job at the data controller or selected for a specific job advertisement

Purpose of data processing

§A Data processing for the purpose of evaluating the application: assessing the applicant's professional suitability for the advertised position. Where the collection of specific personal data serves a different purpose, it is explicitly indicated in the following section.

§A Data processing following the evaluation of the application: direct contact by the data controller for further job opportunities, provided the data subject has consented to this.

Scope of data processed

§A Name, place and date of birth, citizenship, permanent address, residence (purpose of data processing: identification of the applicant)

§A Phone number, email address (purpose of data processing: communication)

§ Data related to the applied position

§A Educational background

§A Professional experience

§ Language skills (in the case of intellectual positions)

§A Salary expectations

§A Public profile on social media (e.g., LinkedIn), if the information provided is relevant to the applied position

§A If necessary: CV and the data contained therein, e.g.

§A Photo, if included in the CV

§A Personal identification data (name, gender, place and date of birth, citizenship)

§A Language skills, educational and other qualifications, professional experience, preferred position, area of interest

§A If applicable, type of driving licence, as well as

§A Other data included in the CV.

§A If necessary: motivation letter and its content. Please do not include information in your CV or motivation letter that is not relevant to the establishment of an employment relationship!

Legal basis for data processing

The applicant's consent. We inform you that you are not obliged to provide your consent. However, if you do not consent to data processing for the purpose of recruitment, we cannot evaluate your job application. If you have given your consent, you may withdraw it at any time without providing a reason. Withdrawal does not affect the lawfulness of data processing carried out based on consent before its withdrawal.

Duration of data processing

§A In the case of an unsuccessful application, 90 days following the evaluation of the job application, unless the data subject has consented to further contact.

§A If the data subject has consented, or the data subject did not apply for a specific job, the CV (application) will be retained and used for two years to communicate job opportunities.

§A In the case of a successful application, the data provided during the application process that is necessary for establishing and maintaining the employment relationship will continue to be processed by the data controller, as outlined in a separate notice provided to employees.

Information on data transfers

The data controller does not plan to transfer the data subject's personal data to a third country (non-EEA country). The data controller may transfer the data subject's personal data to its contracting partners for the purpose of fulfilling the contract with the data subject or for supervisory purposes. Furthermore, the data subject's data may be transferred on an ad hoc basis to service providers engaged by the data controller, such as lawyers, auditors, or financial advisors, if this is absolutely necessary, e.g., in the context of a legal dispute or the financial or accounting assessment of an economic event. These service providers are bound by professional or contractual confidentiality obligations.

Rights of the data subject

Right to information: The data subject may, at any time, request information about the data processing affecting them via the contact details provided in this notice. They may request the rectification, deletion, or restriction of processing of their data, and object to the processing of such personal data.

Right of access: Upon request, the data controller will inform the data subject whether their personal data is being processed. If so, the data subject is entitled to access the personal data processed about them, as well as information about the purpose of the processing, the categories of data concerned, the recipients or categories of recipients to whom the data has been or will be disclosed, the planned duration of data processing or the criteria for determining it, and the source of the data.

Upon request, the data controller will provide a copy of the personal data subject to processing. For additional copies requested by the data subject, a reasonable fee based on administrative costs may be charged. If the request is submitted electronically, the information must be provided in a widely used electronic format, unless the data subject requests otherwise.

Right to rectification: The data subject may request the correction of inaccurate data and also has the right to request the completion of incomplete data.

Right to withdraw consent: The data subject has the right to withdraw their consent to the processing of their personal data at any time. Withdrawal of consent does not affect the lawfulness of data processing carried out based on consent before its withdrawal.

Right to erasure: The data subject may request the deletion of their personal data if

the data is no longer necessary for the purpose for which it was processed;
the data subject withdraws their consent, and there is no other legal basis for the processing;
the conditions for objection to processing are met;
the processing is unlawful;
the data must be deleted to comply with a legal obligation applicable to the data controller;
the data subject is a minor under the age of 16.

The data controller will delete the data upon such a request, except if further processing is necessary for

compliance with a legal obligation applicable to the data controller,
the establishment, exercise, or defence of legal claims.

Right to restriction of processing: The data subject may request restriction of processing if

the data subject contests the accuracy of the personal data, in which case the restriction applies for a period enabling the data controller to verify the accuracy of the data,
the processing is unlawful, but the data subject opposes the deletion of the data and requests restriction instead,
the data controller no longer needs the data for processing purposes, but the data subject requires it for the establishment, exercise, or defence of legal claims,
the data subject has objected to processing, in which case the restriction applies until it is determined whether the data controller's legitimate grounds override those of the data subject.

If processing is restricted as described above, such personal data – with the exception of storage – may only be processed with the data subject's consent, or for the establishment, exercise, or defence of legal claims, or for the protection of the rights of another person, or for reasons of important public interest of the European Union or a Member State. The data controller will inform the data subject requesting the restriction before lifting it.

The data controller will notify the data subject and all recipients to whom the data was previously disclosed of any rectification, deletion, or restriction, unless this proves impossible or involves disproportionate effort. If the data controller has made the personal data public and is obliged to delete it, it will take reasonable steps – including technical measures – to inform other controllers processing the data that the data subject has requested the deletion of any links to, or copies or replications of, the personal data.

Right to object: The data subject may object to the processing of their personal data

a) if it is based on legitimate interest; in this case, processing may not continue unless there are compelling legitimate grounds that override the data subject's interests, rights, and freedoms, or for the establishment, exercise, or defence of legal claims,
b) if it is for direct marketing purposes or related to such purposes; in this case, processing for this purpose may no longer continue.

Right to data portability: The data subject may request that the data controller provide their personal data in a structured, commonly used, and machine-readable format, and may transmit it to another controller, or request that the data be transmitted directly from one controller to another, if technically feasible.

Right to lodge a complaint: If the data subject believes their rights related to personal data have been violated, they are encouraged to report their complaint to the data controller or the data protection officer using the contact details provided above.

The data subject may also lodge a complaint with the competent authority. If they choose to do so, they can submit their complaint to the authority at the following contact details:

National Authority for Data Protection and Freedom of Information

Address: 1055 Budapest, Falk Miksa Street 9-11.

Mailing address: 1363 Budapest, Pf.: 9.

Phone: +36 -1-391-1400

Fax: +36-1-391-1410

Email: ugyfelszolgalat@naih.hu

If the data subject experiences unlawful data processing, they may also initiate a civil lawsuit. The court with jurisdiction is the tribunal. The lawsuit may also be initiated at the tribunal of the data subject's residence (a list of tribunals and their contact details can be found at http://birosag.hu/torvenyszekek).

Investigation of claims

The data controller will provide information to the data subject about the measures taken in response to their request without undue delay, but no later than one month from the receipt of the request. If necessary, considering the complexity of the request and the number of requests, this deadline may be extended by an additional two months. The data controller will inform the data subject of the extension and the reasons for the delay within one month of receiving the request. If the request was submitted electronically, the information will also be provided electronically, unless the data subject requests otherwise. If we determine that no action is required in response to the data subject's request, we will inform the data subject without delay, but no later than one month from the receipt of the request, of the reasons for the lack of action and their right to lodge a complaint with the data protection authority or seek judicial remedy.

Requests are fulfilled free of charge; however, if a request is clearly unfounded or – particularly due to its repetitive nature – excessive, the data controller may charge a reasonable fee based on administrative costs or refuse to act on the request.

If there are reasonable doubts about the identity of the data subject submitting the request, additional information necessary to confirm their identity may be requested.

Effective: 18 February 2025

MIDMAR Nonprofit Ltd.

Annex

Data transfers related to the Miskolc Pass Classic and Miskolc Pass tourist cards

The data controller transfers the cardholder's card data to the following entities in connection with the operation of the card system, for the purpose of verifying the card's validity:

Anyukám Mondta Ltd. – Pizza, Coffee, World Peace

Headquarters: 3860 Encs, Petőfi Street 57.

Tax number: 11701279-2-05

Aura Gold Ltd. - Calimbra Wellness and Conference Hotel

Headquarters: 3519 Miskolc, Bencések Road 9-11.

Tax number: 14002627-2-05

Auto-Tapolca Ltd. – Zenit Guesthouse

Headquarters: 3519 Miskolc, Miskolctapolcai Road 25-27.

Tax number: 11588779-2-05

Bankó-Stúdió Ltd. – Canon Cartridge Discount

Headquarters: 3525 Miskolc, Jókai Street 5.

Tax number: 10738737-2-05

Belvárosi Oroszlán Pharmacy Bt.

Headquarters: 3530 Miskolc, Széchenyi Street 76.

Tax number: 21319114-2-05

Bükki Artisan Wines Ltd. – Zsolt Sándor Organic Vineyard and Winery

Headquarters: 3526 Miskolc, Huba Street 7.

Tax number: 24306458-2-05

Bükk National Park Directorate – Szeleta Park Visitor Centre, Anna Cave, St. Stephen Cave

Headquarters: 3304 Eger, Sánc Street 6.

Tax number: 15323864-2-10

Corneo Eco Ltd. - Cat's Eye Optics

Headquarters: 3821 Keresztéte, Main Road 12.

Tax number: 23916889-2-05

Diósgyőri Várkert Ltd. – Diósgyőri Castle Garden Guesthouse

Headquarters: 3535 Miskolc, Tapolcarét Road 2/a.

Tax number: 11995223-2-05

Grandette Perfect Hospitality and Service Ltd. - Renomé Café & Bistro

Headquarters: 3525 Miskolc, Dayka Gábor Street 13/A ground floor 4. door

Tax number: 32346741-2-05

Gold Park Ltd. - Kikelet Club Hotel***

Headquarters: 3519 Miskolc, Fenyő Street 7.

Tax number: 11584500-2-05

Herman Ottó Museum

Headquarters: 3529 Miskolc, Görgey Artúr Street 28.

Tax number: 15350851-2-05

Íz-Kalauz Ltd. – Végállomás Bistro & Wine

Headquarters: 3535 Miskolc, Fülepp József Street 40.

Tax number: 239473752-05

Ferenc Katona sole trader

Headquarters: 3517 Miskolc-Szentlélek, Outskirts 1105/1 hrsz.

Tax number: 45398463-1-25

Leves Gastronomy Workshop Ltd. – A Leves and Borsod Burger

Headquarters: 3525 Miskolc, Széchenyi István Road 89.

Tax number: 24979195-2-05

Libegőpark Ltd.

Headquarters: 3517 Miskolc, Erzsébet Promenade 77.

Tax number: 23449561-2-05

Miskolc Baths Ltd.

Headquarters: 3519 Miskolc, Pazár István Promenade 1.

Tax number: 14140549-2-05

Miskolc National Theatre Nonprofit Ltd.

Headquarters: 3525 Miskolc, Déryné Street 1.

Tax number: 23862474-2-05

Miskolc Sports Centre Ltd. – Kemény Dénes Sports Swimming Pool

Headquarters: 3515 Miskolc, University Road 2.

Tax number: 24364577-2-05

Miskolc Symphony Orchestra Nonprofit Ltd.

Headquarters: 3525 Miskolc, Fábián Street 6/a.

Tax number: 23834967-2-05

Miskolc City Manager Nonprofit Ltd. - Miskolc Zoo

Headquarters: 3531 Miskolc, Győri Gate 48-50.

Tax number: 20643522-5-05

MVK Miskolc City Transport Closed Joint-Stock Company

Headquarters: 3527 Miskolc, Szondi György Street 1.

Tax number: 11072315-2-05

OSTI Ltd. - Alfa Hotel*** Superior

Headquarters: 3519 Miskolc, Fenyő Street 17.

Tax number: 10512485-2-05

Palacsízió Ltd. - Creppy Pancake House Restaurant and Creppy Center Event Hall

Headquarters: 3530 Miskolc, Nagyavasi Cellar Row 212.

Tax number: 24688563-2-05

Pop-Sarok Bt. – Pop-Sarok Gift Shop

Headquarters: 3530 Miskolc, Szemere Street 3. ground floor 5.

Tax number: 29549236-2-05

Premium Oven Inn Ltd. – Tapolca Inn, Kemencés Kisvendéglő

Headquarters: 3519 Miskolc, Csabai Road 36.

Tax number: 25372687-2-05

S.S. Club Ltd. Impresszó Club - Restaurant

Headquarters: 3530 Miskolc, Széchenyi I. Road 94. 2/6

Tax number: 12756894-2-05

RIPEKU Consulting Ltd. – Józan Driver - Driver Service Miskolc

Headquarters: 3526 Miskolc, Pozsonyi Road 88. 1st floor 2.

Tax number: 27487165-2-05

Steelvent Plc. - Dűlő Restaurant

Headquarters: 3527 Miskolc, Besenyői Street 8.

Tax number: 11883995-2-05

Szabó and Partner Ltd. - Hotel Tókert Hotel and Restaurant

Headquarters: 3517 Miskolc-Lillafüred Erzsébet Promenade 3.

Tax number: 11389075-2-05

TOP-ROOM Ltd. - Aranykorona Historical Restaurant, Hotel, and Wine Cellar

Headquarters: 3530 Miskolc Kisavas First Row 19-20.

Tax number: 11589268-2-05

VITÁL-LAND Service Social Cooperative - Miskolctapolca Adventure Park

Headquarters: 3519 Miskolctapolca, Garas Sámuel Street

Tax number: 25296345105

Wondex Ltd. - Wondex Creative & Stationery

Headquarters: 3526 Miskolc, Szeles Street 29.

Tax number: 11066640-2-05

DATA PROCESSING INFORMATION

More Pages

Our partners