Privacy Policy

Effective as of: 1 October 2026

As the operator of the budapestnewyear.com online store, Todo Hungary Group Kft. (hereinafter referred to as the “Data Controller”) is committed to protecting the personal data of users and customers (hereinafter referred to as the “Data Subjects”). The purpose of this Privacy Notice is to provide transparent information on the processing of personal data in accordance with the General Data Protection Regulation of the European Union (GDPR – Regulation (EU) 2016/679) and applicable Hungarian legislation.

1. Details of the Data Controller

  • Name: Todo Hungary Group Kft.
  • Registered office and mailing address: 1094 Budapest, Berzenczey utca 39-41., 3rd floor, door 8.
  • Company registration number: 01-09-176093
  • Tax number: 24663395-1-43
  • E-mail address: [email protected]

2. Categories of Personal Data Processed, Purposes and Legal Bases

2.1. Ticket Purchases and Invoicing

  • Personal data processed: Name, e-mail address, billing address (postal code, city, street, house number), telephone number, and the types and amounts of tickets purchased.
  • Purpose of processing: Processing and fulfilling orders, sending electronic tickets (e-tickets), confirming purchases, issuing accounting documents (invoices) as legally required, and notifying customers of any changes to programmes or events.
  • Legal basis for processing: Performance of a contract [Article 6(1)(b) GDPR], and compliance with a legal obligation (issuance of accounting documents as required under the Accounting Act) [Article 6(1)(c) GDPR].
  • Retention period: In accordance with its accounting obligations, the Data Controller is required to retain billing data for 8 years from the date of issuance of the relevant invoice.

2.2. Force Majeure Events, Voucher Management and Rescheduling

  • Personal data processed: Name, e-mail address, original order reference, and the code and value of the voucher issued.
  • Purpose of processing: In the event of a programme or event being cancelled due to an unforeseeable and unavoidable external circumstance (force majeure), managing registrations for rescheduled dates or maintaining individual records of replacement vouchers valid for 12 months, including tracking and redeeming such vouchers.
  • Legal basis for processing: Performance of the contract between the parties [Article 6(1)(b) GDPR].
  • Retention period: 1 year following the expiry date of the voucher issued, for the purposes of avoiding legal disputes and ensuring proper accounting and reconciliation.

3. Data Processors and Data Transfers

The Data Controller engages external service providers (data processors) to provide its services.

3.1. Online Payment Partner (Teya)

For the purpose of processing online bank card payments, the Data Controller transfers certain data to the payment service provider.

  • Name of data processor: Teya Zrt.
  • Categories of data transferred: Name and e-mail address.
  • Nature and purpose of processing: Processing secure online payment transactions, fraud prevention, and handling payment confirmations. Teya’s Privacy Notice is available at https://teya.com.

3.2. Website Hosting Provider

  • Name of data processor: Websupport Magyarország Kft.
  • Registered office: 1119 Budapest, Fehérvári út 97-99.
  • Nature of processing: Provision of IT infrastructure and physical and server-side data storage.

4. Data Security Measures

The Data Controller takes measures to ensure the security of personal data. It implements appropriate technical and organisational measures to protect collected, stored and processed data against unauthorised access, alteration, disclosure, deletion or destruction. Communication through the website and the payment process take place over an encrypted SSL (Secure Sockets Layer) connection. The Data Controller does not store bank card details in its own systems.

5. Rights of Data Subjects

Data Subjects are entitled to request the exercise of the following rights at any time by contacting [email protected]:

  • Right of access: Data Subjects may request information about which of their personal data is being processed and for what purposes.
  • Right to rectification: Data Subjects may request the correction of inaccurate or updated personal data.
  • Right to erasure (“right to be forgotten”): Data Subjects may request the deletion of their personal data, unless processing is required by law (e.g. under the Accounting Act).
  • Right to data portability: Data Subjects may request that the personal data they have provided be supplied in a machine-readable format.

The Data Controller shall examine and fulfil requests received within a maximum of 30 days or, where a request is refused, inform the Data Subject of the refusal and provide reasons for it.

6. Remedies and Complaints

If a Data Subject believes that the processing of their personal data has violated the GDPR or applicable Hungarian legislation, they may lodge a complaint with the following authority:

  • Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
    Address: 1055 Budapest, Falk Miksa utca 9-11.
    Postal address: 1363 Budapest, P.O. Box 9.
    E-mail: [email protected]
    Website: www.naih.hu

In the event of a violation of their rights, the Data Subject may also bring legal proceedings against the Data Controller before a court. Such proceedings fall within the jurisdiction of the regional courts (törvényszék).