PRIVACY

1. Controller and scope of this notice

This privacy notice applies to the website available under the https://pontoonbudapest.com domain.

The controller is Városi Srácok Kft. (registered office: 1072 Budapest, Akácfa utca 47., Hungary; tax number: 24343523-2-42; company registration number: 01-09-172924; email: info@pontoonbudapest.com).

The controller processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the applicable Hungarian laws.

Last updated: April 14, 2026.

2. Processing related to the operation of the website

2.1. Server logs and IT security

Categories of data processed: IP address, requested page and resource URL, timestamp of the request, browser and device related technical data, error data and, where applicable, referrer page.

Purpose of processing: operation of the website, maintenance of service security, incident handling, prevention of abuse and protection of the system.

Legal basis: legitimate interest pursuant to Article 6(1)(f) GDPR.

Retention period: for as long as necessary for operation, troubleshooting and IT security.

Processor: Wevent Hungary Kft. (9094 Tápszentmiklós, Fő utca 38.; tax number: 32537747-2-08).

2.2. Technical cookies and consent management

The website uses its own cookies required for operation.

• pontoon_admin: session cookie used for the administration interface, authentication and security functions; retention period: until the browser is closed.
• pontoon_consent: cookie storing the visitor's cookie choices, consent version and timestamp; retention period: 180 days.

Purpose of processing: ensuring the operation of the website, recording consent status and enforcing the visitor's choices.

Legal basis: for technically necessary cookies, legitimate interest pursuant to Article 6(1)(f) GDPR; for optional analytics and marketing processing, consent pursuant to Article 6(1)(a) GDPR.

3. Third-party services

3.1. Google Tag Manager

Categories of data processed: IP address, browser and device data, technical data relating to website use and information relating to consent status.

Purpose of processing: technical management of analytics and marketing tags, enforcement of consent settings and control of related code loading.

Legal basis: for technical operation, legitimate interest pursuant to Article 6(1)(f) GDPR; for optional analytics and marketing processing, consent pursuant to Article 6(1)(a) GDPR.

Recipients: Google Ireland Limited, Google LLC.

3.2. Webfont service

Categories of data processed: IP address, browser data and request-related technical data.

Purpose of processing: delivery of typographic elements of the website through an external font service.

Legal basis: legitimate interest pursuant to Article 6(1)(f) GDPR.

Recipients: Adobe Systems Software Ireland Limited, Adobe Inc.

3.3. Google Maps embed

Categories of data processed: IP address, browser and device data and technical data relating to the loading of the embedded map.

Purpose of processing: displaying the venue location and facilitating route planning.

Legal basis: legitimate interest pursuant to Article 6(1)(f) GDPR.

Recipients: Google Ireland Limited, Google LLC.

3.4. jsDelivr content delivery network

Categories of data processed: IP address and technical data necessary to deliver requested files.

Purpose of processing: fast and reliable delivery of JavaScript assets.

Legal basis: legitimate interest pursuant to Article 6(1)(f) GDPR.

Recipients: jsDelivr / Volentio JSD Limited.

4. Newsletter subscription

Categories of data processed: the email address provided by the subscriber and technical data relating to the subscription event.

Purpose of processing: sending newsletters, event updates and related marketing communications.

Legal basis: consent pursuant to Article 6(1)(a) GDPR.

Retention period: until withdrawal of consent or unsubscribe.

Recipients / processors: The Rocket Science Group LLC d/b/a Mailchimp.

Newsletter subscription is performed through the Mailchimp system; the controller does not store a separate local newsletter list.

5. Transfers to third countries

Certain service providers used by the website may process data outside the European Economic Area. In such cases, transfers are carried out subject to the safeguards set out in Chapter V GDPR, including adequacy decisions, the EU-U.S. Data Privacy Framework or standard contractual clauses, as applicable.

6. Contact

If a data subject contacts the controller by email, the controller processes the email address, the name included in the message and any additional personal data voluntarily provided by the data subject.

Purpose of processing: responding to the enquiry, maintaining contact and handling related claims.

Legal basis: consent pursuant to Article 6(1)(a) GDPR and/or legitimate interest pursuant to Article 6(1)(f) GDPR.

Retention period: until the matter is closed and, where necessary, for as long as required for the establishment, exercise or defence of legal claims.

7. Rights of data subjects

Data subjects have the right of access, rectification, erasure, restriction of processing, data portability and objection in accordance with the GDPR. Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal.

Requests relating to the exercise of data subject rights may be sent to info@pontoonbudapest.com.

8. Remedies

Data subjects may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (1055 Budapest, Falk Miksa utca 9-11; postal address: 1363 Budapest, Pf. 9.; email: ugyfelszolgalat@naih.hu; phone: +36 (1) 391-1400; web: https://www.naih.hu/ugyfelszolgalat-kapcsolat) and may also seek judicial remedy before the competent court.