Privacy policy
Last updated:
Draft – the final text is approved by a legal expert.
1. Controller
The controller of the personal data given on this website is the service provider (Celeritas). Contact details:
| Service provider | Celeritas SCH Oktatási és Kiképző Korlátolt Felelősségű Társaság |
|---|---|
| Short name | Celeritas SCH Kft. |
| Registered office | 1139 Budapest, Teve utca 12–14. IV. em. 74. |
| Premises (shooting range) | 1239 Budapest, Grassalkovich út 294., District XXIII (Soroksár) |
| booking@celeritas-sch.com | |
| Phone | pending |
| Registry court, company registration number | Fővárosi Törvényszék Cégbírósága, Cg. 01-09-961726 |
| Tax number | 23356498-2-41 |
| EU VAT number | HU23356498 |
| Operating permit | BRFK, no. pending, issued: pending |
| Complaints | 1139 Budapest, Teve utca 12–14. IV. em. 74., booking@celeritas-sch.com |
| Association (membership for shooting) | Celeritas Sportlövész Egyesület, Tax number: 18285178-1-41 |
| Hosting provider | BeoHosting, beohosting.com |
| Conciliation board | Budapesti Békéltető Testület, 1016 Budapest, Krisztina krt. 99. I. em. 111., 1253 Budapest, Pf. 10, +36 1 488 2131, bekelteto.testulet@bkik.hu, bekeltet.bkik.hu In a consumer dispute you may also turn to the conciliation board competent for your place of residence or stay. |
| Consumer protection authority | Nemzeti Kereskedelmi és Fogyasztóvédelmi Hatóság, 1122 Budapest, Városmajor utca 35., ugyfelszolgalat@nkfh.gov.hu |
| Data protection authority | Nemzeti Adatvédelmi és Információszabadság Hatóság, 1055 Budapest, Falk Miksa utca 9–11., 1363 Budapest, Pf. 9, ugyfelszolgalat@naih.hu, naih.hu |
The data of the one-day association membership needed for shooting (membership form) are processed on site by the Celeritas Sport Shooting Association, which informs you on site. Appointing a data protection officer is not mandatory.
2. Purposes, legal bases and retention
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Booking and performing the service | name, e-mail, phone, country, language, note; package, slot, number of persons, gun list, names of participants on CUSTOM lists | performance of a contract (Art. 6(1)(b) GDPR) | phone, note, participant names and IP hash are deleted 30 days after the event; the name and e-mail of the booker are anonymized after 5 years |
| Unpaid, abandoned booking | the same | steps before a contract (Art. 6(1)(b)) | deleted after 30 days |
| Deposit payment and refunds | transaction ID, amount, currency, status, time (no card data) | contract, legal obligation (Art. 6(1)(b), (c)) | 8 years (accounting law); the technical log is deleted after 24 months |
| Invoicing | name or company name, address, tax / VAT number | legal obligation (Art. 6(1)(c)) | 8 years |
| Gift voucher | buyer’s name and e-mail; recipient’s name, e-mail and message (if given) | contract, legal obligation | buyer: 8 years; recipient: 12 months after use or expiry |
| Withdrawal, complaint | content of the statement or complaint, name, e-mail, answer | legal obligation (Art. 6(1)(c)) | 3 years |
| Group request, contact | name, e-mail, phone, message | steps before a contract, legitimate interest (Art. 6(1)(b), (f)) | 12 months |
| Cookies: statistics and marketing | cookie IDs, event data | consent (Art. 6(1)(a)) | on your device: see the Cookie policy |
| Server-side statistics (Google Analytics 4 Measurement Protocol) | Google Analytics client and session ID, campaign parameters (utm) and the path of the landing page; the reference and amount of the booking or purchase | consent (“Statistics” category; campaign parameters and landing page with the “Statistics” or the “Marketing” category) | Google Analytics IDs are deleted after sending, at the latest after 72 hours; campaign parameters and the landing page at the latest after 72 hours |
| Server-side ad measurement (Meta Conversions API, Google Enhanced Conversions) | SHA-256 hashes of the booker’s e-mail, phone and name; IP address, browser ID, ad click IDs (gclid, fbclid / fbc, fbp) | consent (“Marketing” category) | IP address, browser ID and Meta IDs are deleted after sending, at the latest after 7 days; click IDs after 30 days |
| Proof of cookie consent | consent ID, version, choice, language, time, page (no IP address) | legal obligation (Art. 7(1) GDPR) | 24 months |
| Security and administration log | user, action, time, IP hash | legitimate interest (Art. 6(1)(f)) | 12 months |
We do not ask for identity documents, birth data or health data online; age and identity are checked on site.
3. Processors and recipients
- Hosting, operation, backups: BeoHosting (processor under a data processing agreement; data stored in the European Union).
- Online payment: the payment provider shown on the payment page (e.g. Worldline / Saferpay) processes card data as an independent controller.
- Invoicing: the accountant and the provider of the invoicing software (processor).
- Google (Google Analytics, Google Ads, Google Tag Manager, Google Maps, YouTube): only with your consent.
- Meta Platforms Ireland (Facebook / Instagram Pixel and Conversions API): only with your consent; we are joint controllers for the collection and transfer.
Transfers to the United States rely on the EU–US Data Privacy Framework (adequacy decision of 10 July 2023).
4. Your rights
You may request access to, rectification or erasure of your data or restriction of processing, object to processing based on legitimate interest and request data portability. You may withdraw your consent at any time (for cookies with the “Cookie settings” link at the bottom of every page) without affecting the lawfulness of earlier processing. We answer within one month. Accounting records and the data of ongoing contracts are kept for the period required by law.
You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or go to court; the NAIH contact details are in section 1.
5. Cookies
Details are in the Cookie policy.
6. Security
We receive data over an encrypted connection (HTTPS), access depends on roles, codes and links are stored encrypted or hashed, and backups are encrypted. We notify the authority of a personal data breach within 72 hours.
