Privacy Policy

1. Data controller

Zefram Innovation Kft.
Registered seat: 3065 Pásztó, Vár utca 69., Hungary
Company registration no.: 12 09 008525
Tax number: 24370383-2-12
E-mail: [email protected]
Phone: +36 30 475 8383
(the "Controller")

2. Purpose and scope

This notice covers the personal data processed through the use of matrakaland.hu (the "Website"), the booking process and payment, under Regulation (EU) 2016/679 (GDPR) and Hungarian Act CXII of 2011 on informational self-determination.

3. Data processed

a) Booking data
Data: name, e-mail address, phone number, number of participants, tour/rental details.
Purpose: recording and confirming the booking, performing the service, communication.
Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
Retention: 8 years for billing data (Hungarian Accounting Act), 5 years for other data (general limitation period).

b) Payment data
The Controller never sees or stores card/payment data; this is processed solely by the chosen payment provider, acting as an independent controller: Stripe Payments Europe, Ltd. (The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland; privacy policy: stripe.com/privacy), or Barion Payment Zrt. (registered seat: 1117 Budapest, Irinyi József utca 4-20., Hungary; company reg. no. 01-10-048552; an e-money institution supervised by the Central Bank of Hungary, licence no. H-EN-I-1064/2013; details: barion.com/hu/jogi-informaciok). The payment method(s) currently available are shown on the booking form.
Legal basis: performance of a contract, and for the payment providers, compliance with payment-services and anti-money-laundering law.

c) Barion Pixel (fraud prevention)
The Website uses the base Barion Pixel, which collects technical/device data (e.g. IP address, browser and device characteristics) from visitors to prevent payment fraud. Barion Payment Zrt. acts as an independent controller for this processing; the Controller has accepted Barion Pixel's supplementary terms.
Legal basis: the legitimate interest of the Controller and Barion Payment Zrt. in fraud prevention (GDPR Art. 6(1)(f)).
The Website uses the full version of the Barion Pixel: in addition to the base (fraud-prevention) operation it also collects marketing and analytics behavioural data (e.g. viewed tours, booking events) — solely with the data subject's consent. The legal basis for this marketing processing is consent (GDPR Art. 6(1)(a)), which can be changed or withdrawn at any time via the “Cookie settings” link in the footer.

d) Contact requests
Data: name, e-mail/phone, message content. Purpose: responding to the enquiry. Legal basis: consent (GDPR Art. 6(1)(a)). Retention: 1 year.

e) Marketing and analytics processing (Google Analytics, Google Ads)
Data: technical device/browser characteristics, (shortened/anonymised) IP address, on-site browsing behaviour (pages viewed, clicks, conversions), ad-click identifiers (e.g. Google Click ID).
Purpose: statistical analysis of Website usage (Google Analytics, GA4), and measuring ad campaigns, remarketing and personalised advertising (Google Ads).
Legal basis: the data subject's prior, freely given consent (GDPR Art. 6(1)(a)), given or refused via the cookie-settings tool on the Website; consent can be withdrawn at any time.
Controller/processor: for Google Analytics, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) acts as the Controller's processor; for Google Ads (remarketing, ad personalisation), Google acts as an independent controller. Data may be transferred outside the EEA to the United States, subject to appropriate GDPR safeguards (Standard Contractual Clauses).
Retention: per Google Analytics' data-retention setting (typically 14 months); Google Ads cookies are governed by Google's then-current policy.
Opt-out: consent can be withdrawn at any time via the cookie-settings tool; Google Analytics tracking can also be disabled via the Google Analytics Opt-out browser add-on (tools.google.com/dlpage/gaoptout), and personalised ads can be turned off at Google's Ads Settings (adssettings.google.com). Google's privacy policy: policies.google.com/privacy.
The measurement and advertising services above are loaded through the Google Tag Manager tag-management system (Google Ireland Limited). Google Tag Manager itself does not collect personal data and is only activated after consent has been given; without consent, neither Google Tag Manager nor the measurement codes it manages are loaded.

f) First-party, cookieless visitor statistics
The Controller measures Website traffic on its own server, without cookies and without any third-party service.
Data: the page viewed and the time of the visit, the domain of the referring website, campaign parameters (UTM), device type, browser and operating system name, browser language. The IP address and the browser identifier (user agent) are used only in memory while the request is processed, to derive a pseudonymous visitor ID (a hash created with a random key that changes daily); the IP address is not stored. The key is deleted the following day, so the ID cannot be reversed and visits on different days cannot be linked. The Controller only produces aggregated statistics from this data; it does not identify data subjects or create profiles.
Purpose: statistical analysis of Website usage and of the booking process, and detection of broken links and technical errors.
Legal basis: the Controller's legitimate interest in operating and improving the Website (Article 6(1)(f) GDPR). Data subjects may object to this processing by writing to [email protected].
Retention: statistical records are kept for no more than 400 days and are then deleted automatically.
Recipients: the data is not disclosed to third parties; it is stored on the Website's server (Hetzner Online GmbH, Germany, see section 4).

4. Processors

• Stripe Payments Europe, Ltd. — payment service (details in 3.b); an independent controller for payment processing. Data may be transferred outside the EEA (USA), subject to appropriate GDPR safeguards (Standard Contractual Clauses).
• Barion Payment Zrt. — payment service (details in 3.b).
• Resend, Inc. — sending transactional e-mails (confirmation, reminders). Data may be transferred outside the EEA (USA); appropriate safeguards under GDPR (e.g. Standard Contractual Clauses) apply.
• Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) — hosting the Website's server.
• Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) — Google Analytics (GA4) for statistical analysis, as processor.
• Google LLC / Google Ireland Limited — Google Ads advertising and remarketing service; Google acts as an independent controller in this respect.

Processors act on the Controller's instructions without independent decision-making authority, except the payment providers (Stripe, Barion) for payment processing, and Barion for fraud prevention, where they act as independent controllers.

5. Data subject rights

You may request information about your data, rectification, erasure or restriction of processing, object to processing, and exercise your right to data portability, by writing to [email protected]. Requests are handled without undue delay, within one month at the latest.

6. Remedies

You may go to court, or lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9-11., Hungary; postal address: 1363 Budapest, P.O. Box 9; phone: +36 1 391 1400; e-mail: [email protected]; website: www.naih.hu.

7. Cookies

The Website uses the following cookie categories:

• Strictly necessary cookies — required for the Website to function; no consent is needed.
• Barion Pixel — base operation (ba_vid, ba_sid cookies) — strictly necessary, for fraud prevention, based on the legitimate interest of the Controller and Barion Payment Zrt. (see 3.c).
• Barion Pixel — marketing (BarionMarketingConsent and related marketing cookies) — activated only with the data subject's consent (see 3.c); consent can be changed or withdrawn at any time via the “Cookie settings” link.
• Analytics cookies (Google Analytics/GA4) and marketing/advertising cookies (Google Ads) — activated only with the data subject's prior consent (see 3.e); consent is given or withdrawn at any time via the cookie-settings tool on the Website.
• First-party visitor statistics — uses no cookies and stores no data in the browser (see 3.f).

8. Changes to this notice

The Controller may amend this notice; the current version is always available on the Website.

Last updated: 26 October 2026.