1. Details of the Data Controller

 

Name of the Data Controller: Günzer Zoltán, Sole Proprietor  

Registered office / business premises: 6 Oportó Street, 7773 Villány, Hungary  

Tax number: 43576306-2-22

Registration number: 5169085

Email: gunzer@gunzer.com 

Telephone: +36 20 262 2522  

Website: www.gunzer.com

 

Hereinafter referred to as the Data Controller, Günzer Family Estate, Günzer or the Winery.

 

---

 

2. Scope of this Privacy Notice

 

This Privacy Notice applies to the processing of personal data through the www.gunzer.com website and the services connected to it.

 

In particular, this Privacy Notice covers the following processing activities:

 

use of the website, online shop orders, delivery, invoicing, online payment, table reservations, wine-tasting bookings, Ördögárok vineyard tour bookings, Wine & Valley programme bookings, corporate and group enquiries, wine club memberships, Palack Piac purchases, newsletter subscriptions, contact requests, complaint handling, cookies and other website technologies.

 

---

 

3. Principles of Data Processing

 

When processing personal data, the Data Controller seeks to ensure that processing is lawful, fair and transparent.

 

Personal data is processed only for specified, explicit and legitimate purposes.

 

We request only data that is necessary to provide the relevant service, communicate with you, issue invoices, arrange delivery, manage bookings, process enquiries or comply with legal obligations.

 

We retain personal data only for as long as necessary, unless a longer retention period is required by law.

 

We protect personal data by appropriate technical and organisational measures against unauthorised access, alteration, deletion or disclosure.

 

---

 

4. Categories of Personal Data Processed

 

When the website is used and services are requested, the Data Controller may process the following personal data:

 

name, email address, telephone number, billing name, billing address, delivery name, delivery address, tax number for business purchases, order details, products purchased, booking details, number of participants, date and time, programme type, enquiry details, information entered in comment fields, payment status, transaction identifiers, newsletter subscription data, user-account data, IP address, browsing data, cookie identifiers, and technical device and browser data.

 

Please do not provide special-category personal data, such as health information, in comment fields unless it is strictly necessary for the safe provision of the selected programme and is provided voluntarily.

 

---

 

5. Data Processing Related to Website Use

 

When the website is visited, the system may process technical data such as the IP address, browser type, device data, date and time of the visit, pages viewed and cookie data.

 

Purpose of processing: secure operation of the website, error prevention, technical maintenance, improvement of user experience and prevention of misuse.  

Data processed: IP address, technical device data, browsing data and cookie data.  

Legal basis: the legitimate interest of the Data Controller in the secure and proper operation of the website and, in the case of certain cookies, the user’s consent.  

Retention period: technical data is retained in the service provider’s systems and logs for the period necessary and in accordance with the provider’s settings.

 

---

 

6. Processing of Online Shop Orders

 

When a purchase is made through the online shop, the Data Controller processes the data necessary to fulfil the order.

 

Purpose of processing: processing the order, handling payment, invoicing, delivery, communication, customer information and complaint handling.  

Data processed: name, email address, telephone number, billing address, delivery address, tax number for business purchases, order details, payment status and transaction data.  

Legal basis: performance of a contract, compliance with a legal obligation and the legitimate interests of the Data Controller.  

Retention period: for accounting documents, the retention period required by law; for other order data, for as long as necessary to perform the contract, enforce legal claims and handle complaints.

 

---

 

7. Data Processing Related to Invoicing

 

An invoice may be issued for purchases and certain services.

 

Purpose of processing: issuing invoices and complying with accounting and taxation obligations.  

Data processed: billing name, billing address, tax number for business purchases, products or services purchased and payment data.  

Legal basis: compliance with a legal obligation.  

Retention period: the period required by accounting legislation.

 

---

 

8. Data Processing Related to Delivery

 

Where the customer selects home delivery or parcel delivery, the Data Controller processes the data necessary for delivery and may transfer it to the delivery service provider.

 

Purpose of processing: delivery of ordered products, parcel handover and communication relating to delivery.  

Data processed: name, delivery address, telephone number, email address, order identifier and parcel data.  

Legal basis: performance of a contract.  

Data transfer: to the courier service or delivery partner.  

Retention period: for as long as necessary to complete delivery, handle complaints and enforce legal claims.

 

---

 

9. Data Processing Related to Online Payment

 

Online payment available through the website may be processed with the involvement of an external payment service provider.

 

Purpose of processing: processing online payment, identifying the payment transaction, confirmation and handling refunds.  

Data processed: name, email address, order identifier, payment status, transaction identifier and data processed by the payment service provider.  

Legal basis: performance of a contract, compliance with a legal obligation and legitimate interests.  

Note: the Data Controller does not directly store bank-card details; these are processed by the payment service provider.

 

---

 

10. Processing of Table Reservations

 

When a table is reserved, the Data Controller processes the data necessary for the reservation.

 

Purpose of processing: recording, confirming, modifying and cancelling table reservations, preparing for guests and communication.  

Data processed: name, email address, telephone number, reservation date and time, number of guests, comments and selected extras.  

Legal basis: performance of a contract and the legitimate interests of the Data Controller in managing reservations and organising hospitality services.  

Retention period: for as long as necessary to fulfil the reservation, handle any complaint and enforce legal claims.

 

---

 

11. Processing of Bookings for Wine Tastings, the Ördögárok Vineyard Tour and Wine & Valley

 

When a wine tasting, Ördögárok vineyard tour or Wine & Valley programme is booked, the Data Controller processes the data necessary to organise the programme.

 

Purpose of processing: managing programme bookings, sending confirmations, managing participant numbers and dates, preparing the programme, communicating with guests and handling modifications or cancellations.  

Data processed: name, email address, telephone number, programme type, date and time, number of participants, comments, selected extras, payment status and contact details.  

Legal basis: performance of a contract, legitimate interests and, where applicable, compliance with a legal obligation.  

Retention period: for as long as necessary to provide the programme, handle complaints and enforce legal claims.

 

For the Ördögárok vineyard tour, information relating to the Guest’s health is requested only where necessary for the safe provision of the programme. The tour takes place on unpaved roads in an off-road vehicle and is therefore not recommended for guests with spinal or back conditions. Providing such information is voluntary and may be used solely to organise the programme safely.

 

---

 

12. Data Processing for Corporate Events, Team-Building Programmes and Requests for Quotations

 

The website may be used to request a quotation for a corporate event, team-building programme, private programme or group hospitality service.

 

Purpose of processing: processing the request, preparing a quotation, communication, programme planning and preparation of a contract.  

Data processed: name, company name, email address, telephone number, proposed date, number of participants, programme type, catering requirements, invoicing requirements and comments.  

Legal basis: steps taken before entering into a contract, legitimate interests and, where applicable, consent.  

Retention period: for the validity period of the quotation and for the period necessary for communication, conclusion of a contract or enforcement of legal claims.

 

---

 

13. Processing of Wine Club Memberships

 

When a wine club membership is used, the Data Controller processes the data necessary to manage the membership.

 

Purpose of processing: creating and managing wine club membership, managing membership packages, payment, invoicing, delivery, communication and providing membership benefits.  

Data processed: name, email address, telephone number, billing address, delivery address, payment data, membership status, order data and delivery data.  

Legal basis: performance of a contract, compliance with a legal obligation and legitimate interests.  

Retention period: for the duration of the membership and thereafter in accordance with statutory and legal-claim limitation periods.

 

---

 

14. Processing of Palack Piac Purchases

 

Personal data relating to Palack Piac purchases is processed in the same way as data relating to online shop orders.

 

Purpose of processing: processing orders for discounted or special items, payment, invoicing, delivery and communication.  

Data processed: name, email address, telephone number, billing and delivery data, order data and payment status.  

Legal basis: performance of a contract and compliance with a legal obligation.  

Retention period: the same as for online shop orders.

 

---

 

15. Processing of Contact Requests

 

Where the User contacts the Data Controller by email, telephone, website form, social-media message or another method, the Data Controller processes the data necessary to handle the contact request.

 

Purpose of processing: answering questions, communication, administration, preparing quotations and complaint handling.  

Data processed: name, email address, telephone number, message content and date of communication.  

Legal basis: legitimate interests, consent, steps taken before entering into a contract and, where applicable, performance of a contract.  

Retention period: until the matter is closed and for the period necessary to enforce legal claims.

 

---

 

16. Processing of Newsletter and Günzer Stories Subscriptions

 

The website offers the option to subscribe to a newsletter. The newsletter may be called Günzer Stories.

 

The newsletter may contain estate news, stories about wines, programme recommendations, online shop offers, special opportunities, Palack Piac notifications, wine club information and other Günzer content.

 

Purpose of processing: sending newsletters, marketing communications, offers and content to subscribers.  

Data processed: name, email address, subscription date and newsletter-related activity data, such as opens or clicks, where measured by the newsletter system.  

Legal basis: consent.  

Retention period: until consent is withdrawn, meaning until the subscriber unsubscribes.

 

Subscribers may unsubscribe at any time using the unsubscribe link at the bottom of the emails or by contacting the Data Controller.

 

---

 

17. Automated Emails and System Messages

 

The website and booking system may send automated emails, such as order confirmations, booking confirmations, payment notifications, cancellation links, modification notices or programme-related information.

 

Purpose of processing: providing information necessary to fulfil an order, booking or service.  

Data processed: name, email address and order or booking data.  

Legal basis: performance of a contract, legitimate interests and compliance with a legal obligation.  

Retention period: for the period necessary to complete and document the relevant matter.

 

---

 

18. Processing of User Accounts

 

Where the website allows a user account to be created, the Data Controller processes the data necessary to manage the account.

 

Purpose of processing: creating and managing a user account, accessing purchase and booking history, modifying or cancelling a booking and communication.  

Data processed: name, email address, password in encrypted form, order and booking data and membership data.  

Legal basis: performance of a contract, consent and legitimate interests.  

Retention period: for as long as the account exists and thereafter for the period required by legal and accounting obligations.

 

---

 

19. Cookies and Similar Technologies

 

The website may use cookies and similar technologies. A cookie is a small data file stored by the browser on the user’s device.

 

Cookies may be used, for example, to ensure website functionality, manage login, operate the shopping cart, provide security, support the ordering process, operate the booking system, measure website traffic, improve user experience or measure marketing activities.

 

The main types of cookies are:

 

Essential cookies: these are required for the basic operation of the website, including the shopping cart, login, security, the booking system and technical functionality.

 

Functional cookies: these may help remember user preferences and provide a more convenient browsing experience.

 

Statistical or analytics cookies: these may help us understand how visitors use the website.

 

Marketing cookies: these may help measure and target advertising or reach previous visitors.

 

Cookies necessary for the operation of the website are used to ensure proper website functionality. Non-essential cookies, such as statistical or marketing cookies, may require consent under the applicable rules.

 

By using the website, the User acknowledges that cookies necessary for the operation of the website may be used. If the User does not want the website to use cookies, they may block or delete cookies in their browser or contact us through another available channel to request the relevant service.

 

Cookies may also be managed through browser settings. If all cookies are blocked, certain website functions, such as the shopping cart, purchasing, booking or login, may not work properly.

 

The Data Controller seeks to provide transparent and appropriate information about cookie use on the website. A separate cookie banner or cookie-settings interface is recommended for managing consent relating to non-essential cookies.

 

---

 

20. Wix as Hosting and Technical Service Provider

 

The www.gunzer.com website operates on the Wix platform. Depending on the nature of the relevant service, Wix may act as a data processor or an independent data controller in connection with the technical operation and hosting of the website, website editing, the online shop, the booking system, forms, email notifications and other website functions.

 

Service provider: Wix.com Ltd. and its affiliated companies  

Nature of service: website and hosting services, technical platform, online shop and booking functions, form management, email notifications, security and system-operation services.

 

Wix systems may process technical data, customer data, order data, booking data or form data necessary for the operation of the website. Wix’s processing activities are also governed by Wix’s privacy documents and data-processing terms.

 

Wix is an international service provider, so data may also be processed or stored in countries outside the European Economic Area, subject to appropriate data-protection safeguards.

 

---

 

21. Third-Party Service Providers

 

The Data Controller may use third-party service providers to operate the website and provide its services.

 

Such service providers may include in particular:

 

Wix as website and hosting provider, payment service provider, invoicing software provider, accountant, courier service, newsletter system, analytics provider, advertising provider, Google services, Meta / Facebook / Instagram services, email provider and IT service provider.

 

Third-party service providers receive only the data necessary to provide the relevant service and process it under their own privacy policies or a data-processing agreement.

 

---

 

22. Google Services

 

The website may use Google services such as Google Analytics, Google Search Console, Google Tag Manager, Google Ads, Google Merchant Center or Google Business Profile.

 

Purpose of processing: measuring website traffic, search engine optimisation, managing advertisements, displaying online shop products and measuring campaign performance.  

Data processed: cookie identifiers, IP address, browsing data, device data, conversion data and, in certain cases, product and order data.  

Legal basis: consent, legitimate interests or performance of a contract, depending on the nature of the relevant service.

 

Google services may also process data in accordance with their own privacy policies.

 

---

 

23. Meta / Facebook / Instagram Services

 

The website or the online communications of the Günzer Family Estate may be connected to Meta services, such as a Facebook Page, Instagram profile, Meta Pixel or advertising systems.

 

Purpose of processing: social-media communication, displaying advertisements, measuring campaigns and reaching interested users.  

Data processed: social-media interactions, page views, cookie or pixel data and advertising identifiers.  

Legal basis: consent or legitimate interests, depending on the relevant technology and settings.

 

---

 

24. International Data Transfers

 

Some service providers used to operate the website may have an international background. These may include Wix, Google, Meta and certain payment and technical service providers.

 

Certain data may be transferred to countries outside the European Economic Area. In such cases, the transfer is carried out in accordance with applicable data-protection rules and subject to appropriate safeguards.

 

---

 

25. Data Security

 

The Data Controller applies appropriate technical and organisational measures to keep personal data secure.

 

The technical operation of the website is provided by Wix, which applies its own security measures. The Data Controller seeks to restrict access, manage permissions appropriately and ensure that personal data is processed only by persons who need it to perform their duties.

 

The complete security of data transmission over the internet cannot be guaranteed, but the Data Controller seeks to reduce the risks.

 

---

 

26. Rights of Data Subjects

 

The data subject has the right to request information about the processing of their personal data.

 

The data subject may request access to, correction or deletion of their personal data, restriction of processing and, in certain cases, may object to the processing.

 

The data subject may have the right to data portability where processing is carried out by automated means and is based on consent or a contract.

 

Where processing is based on consent, the data subject may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

 

The data subject may exercise their rights using the following contact details of the Data Controller:

 

Email: gunzer@gunzer.com 

Postal address: 6 Oportó Street, 7773 Villány, Hungary

 

---

 

27. Request for Deletion

 

The data subject may request deletion of their personal data where the purpose of processing no longer exists, where consent is withdrawn, where the data subject objects to processing or where the processing is unlawful.

 

The Data Controller will examine the request for deletion and, where there is no legal or legitimate-interest basis requiring retention, will delete the data.

 

Certain data, such as invoicing data, may not be deleted immediately because of legal obligations.

 

---

 

28. Objection to Processing

 

The data subject has the right to object to processing based on legitimate interests. This may include certain processing carried out for communication or security purposes.

 

Where an objection is submitted, the Data Controller will assess whether there are compelling legitimate grounds that justify continuing the processing.

 

---

 

29. Complaints and Legal Remedies

 

If the data subject believes that their personal data is not being processed appropriately, please contact us first using the following details:

 

Email: gunzer@gunzer.com 

Postal address: 6 Oportó Street, 7773 Villány, Hungary

 

The data subject may also lodge a complaint with the National Authority for Data Protection and Freedom of Information.

 

National Authority for Data Protection and Freedom of Information  

Registered office: 9–11 Falk Miksa Street, 1055 Budapest, Hungary  

Postal address: 1363 Budapest, P.O. Box 9, Hungary  

Website: www.naih.hu  

Email: ugyfelszolgalat@naih.hu

 

The data subject may also seek judicial remedy if they believe that the processing of their personal data infringes their rights.

 

---

 

30. Retention Summary

 

Different categories of personal data are retained for different periods.

 

Online shop order data: for the period necessary to fulfil the order, handle complaints and enforce legal claims.

 

Invoicing data: for the period required by accounting legislation.

 

Booking data: for the period necessary to fulfil the booking, handle complaints and enforce legal claims.

 

Quotation-request data: for the validity period of the quotation and for the period necessary for the business relationship or enforcement of legal claims.

 

Newsletter data: until the subscriber unsubscribes or withdraws consent.

 

Technical and cookie data: for a period depending on the type of cookie, browser settings and service-provider settings.

 

Complaint-handling data: for the period necessary to handle the complaint and enforce legal claims.

 

---

 

31. Amendment of this Privacy Notice

 

The Data Controller reserves the right to amend this Privacy Notice. The amended notice enters into force when it is published on the website.

 

The User is responsible for reviewing the current notice from time to time.

 

---

 

32. Contact

 

For questions about data protection, deletion requests, newsletter unsubscribing, privacy complaints or other data-protection matters, please contact us using the following details:

 

Günzer Family Estate  

6 Oportó Street, 7773 Villány, Hungary  

Email: gunzer@gunzer.com 

Telephone: +36 20 262 2522