Application and Website Privacy Notice Full Privacy Notice

The purpose of this short Privacy Notice (“Privacy Notice”) is to provide you basic information about how VisitBalaton365 Np. Ltd. processes your data when you use Balaton Bike 365 mobile application (“Application”) and the respective website: (“Website”) (Application and Website collectively: “Interface”). The Privacy Notice helps you to better understand how we use your personal data and explains how we collect and use it for and with whom it is shared.

Data Controller

VisitBalaton365 Nonprofit Limited Liability Company (seat: 1011 Budapest, Szilágyi Dezső tér 1.; e-mail address:; “BB365”,„we”, our or „us”) .

Purposes and Legal Basis for Processing Your Personal Data

BB365 processes your personal data for the purposes below:

  • User account registration, managing user account: the processing of your data is necessary for the execution and fulfillment of the related Application and Website Terms of Use, as a contract and to access the services of the Interface.
  • Service provider application: any cycling-friendly service provider may register as a point of interest through the Website.
  • Communication with service providers: you may communicate with any cycling-friendly service provider through the Interface, where we rely on your consent as a legal basis.
  • Location sharing with service providers: you can share your current location with service providers for 60 minutes, so that the service provider can plan a route to your current location, where we rely on your consent as a legal basis.
  • Location sharing: you can share your own location with other group members, if they also turn on location sharing. Location sharing will automatically turn off when you close the location sharing view.
  • Recommend tours, tour planning: registered users may recommend touring routes to each other through the Interface.
  • User statistics and recent activities: you can save your previous tours and you can make related statistics.
  • Service provider and places rating: you may rate service providers and places.
  • Tour group management: you can create and/or join groups through the Interface with your registered friends to organize cycling tours.
  • Communication and contact: the purpose of processing your personal data is to manage your questions and inquiries to us.
  • Add Places: you can add new places that are currently unavailable on the Interface.
  • Newsletters, notifications and marketing communication: the purpose of processing your data is to send you updates about our services and activities.


For the purposes outlined above we process the data categories indicated below:

  • Registration data: including your name, identification data (email address and password), Facebook/Google ID, registration confirmation code.
  • User account data: including your username, user’s e-mail address, saved user activities, user group, group ID, date and time accessing the Interface, logins, profile picture, user type (general/admin), use of language, newsletter subscription (if any), code for password change and its validity date, code for e-mail address change and its validity date.
  • Tour data: including saved touring routes, saved route plans.
  • Location data: including the last geographical location of the user, date of last geographical location.
  • POI data: including POI name, e-mail address, phone number, description details, POI location data, POI picture, details of user assessments.
  • Service provider data: name, e-mail address and phone number of the Service provider (only when browsing Website), service provider rating.
  • Device data: including, type of user device, the internet protocol (IP) address you use to visit our Interface and cookies, local storage and session storage data.
  • Communication data: including details of your question, inquiry, comments or our communication with you.


To process your personal data, we may rely on the legal bases below:

  • The processing of your personal data is necessary for the performance of a contract with you under Article 6 (1) b) of the EU Regulation 679/2016 ("GDPR") (Contract).
  • Your consent provided to us under the Article 6 (1) a) of the GDPR (Consent).
  • The processing of your personal data is possible based on our legitimate interest under of the Article 6 (1) f) of the GDPR (Legitimate Interest).

    BB365 has a legitimate interest in processing data to respond to user's questions, inquiries, and complaints, because BB365 has a legitimate interest in meeting user needs and concerns. If a user has directly contacted BB365 with a question or complaint, it is reasonable for them to expect that their data will be processed to facilitate a response.

    BB365 has a legitimate interest in ranking POIs based on users’ feedback, furthermore, to provide users with the possibility to recommend new POIs through the Interface. It is our legitimate interest to provide up to date information to users relative to POIs and to improve the value of our service through the involvement of new POIs.

    For more information, please contact us at
We may process your personal data for the purposes and legal bases indicated below:
Purpose of data processingCategories of personal data processedLegal Basis
User account registration, managing user account
  • Registration data
  • Device data
  • User account data
Service provider application
  • Service provider data
Communication with service providers
  • User account data
  • Communication data
Location sharing with service providers
  • Location data
  • User account data
Location sharing
  • Location data
  • User account data
Recommend tours, tour planning
  • Location data
  • Tour data
  • User account data
User statistics and recent activities
  • Location data
  • Tour data
  • User account data
Service provider and places rating
  • User account data
  • Service provider data
  • Communication data
Legitimate interest
Managing touring group
  • User account data
  • Location data
Communication and contact
  • User account data
  • Communication data
  • Device data
Legitimate interest
Add Places
  • POI data
Legitimate interest
Newsletters, notifications and marketing communication
  • User account data
  • Device data


We may process and store your personal data as long as necessary for the performance of our services and obligations and strictly for the time necessary to achieve the purposes for which the information was obtained. We will delete your personal data when it is no longer needed.

If we process your personal data based on your consent, we will process and store your personal data until your consent is withdrawn, but in case of marketing communication not longer than two years.

Any personal data relative to any complaint or legal claim will be stored until the statute of limitations under civil laws (i.e., 5 years).

We will retain your data during your contractual with us until the statute of limitations under civil laws (i.e., 5 years). Under Hungarian laws, at least eight years statutory data retention obligation applies to personal data in accounting documents, including contracts, communication and business correspondence.


Within BB365 our staff with appropriate authorization may have access to your personal data on a “need-to-know” basis. We may engage other persons, third parties as data processors to provide services to us and courts, government bodies or other authorities may require us to disclose your data them. We may transfer personal data to third parties for the following reason:

  • With certain third parties: we may transfer your data to external consultants (e.g., lawyers) if this is necessary for responding to legal claims. Your Location data may be transferred to cycling-friendly service providers if you have consented to this in advance. The Interface uses the services of Google Maps to visually display your location data via Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google may transfer your personal data to the USA. Google's privacy policy is available at
  • Service providers: we use externally provided IT-services and systems provided by third party vendors as a support to our internal processes.
Name of the data processorSeatActivity
BIG FISH Kft.1066 Budapest, Nyugati tér 1-2.Website operation
DigitalOcean, LLC101 Avenue of the Americas, 10th Floor, New York, NY 10013 USACloud service provider
Mailjet SAS13 B Rue de l'Aubrac 75012, Ile de France - FranciaországE-mail sending and managing marketing list
OneSignal2850 S Delaware St #201, San Mateo, CA 94403, United StatesMessaging services
Nitro Communications Kft.1036 Budapest Lajos utca 48-66.Prize draw operation
Newsletter communication
B2B Aquisition and database operation
Marketing automation system operation
Hubspot SAS2 Canal Park
Cambridge, MA 02141
United States
database management, sales support, management and operation of marketing lists, email sending
  • Government authorities and enforcement bodies: government authorities or enforcement bodies such as regulatory authorities, upon their request and only as required by the applicable law or to protect our rights or the safety of our customers, staff, and assets.
Personal data may be provided to parties that are located outside the European Economic Area ("EEA"). In such cases, we will ensure that the personal data is subject to measures (such as Standard Contractual Clauses for data transfers) that provide an equivalent level of protection as provided by data privacy laws in the EU (such as the EU General Data Protection Regulation; GDPR).

By way of entering into appropriate data transfer agreements based on Standard Contractual Clauses (2010/87/EU and/or 2004/915/EC) as referred to in Article 46(5) GDPR or other adequate means, we have established that all other recipients located outside the EEA will provide an adequate level of data protection for the personal data and that appropriate technical and organizational security measures are in place to protect Personal Data against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing.

Please contact us via the e-mail address above if you would like to receive from us the copy of these measures that secure the adequacy of personal data transfers abroad.


You are entitled to exercise your rights below:

  • Right of access: You have a right to ask whether or not we have personal data about you and, if that is the case, request information on what personal data we have. We may request additional information from you for identification or for further copies requested by you, we may charge a reasonable fee based on administrative costs.
  • Right to rectification: We are required to rectify inaccurate personal data, or to complete personal data that is incomplete, upon your request.
  • Right to erasure (right to be forgotten): We are in some circumstances required to erase personal data on your request.
  • Right to restriction of processing: We are in some circumstances required to restrict our use of personal data on request by the person concerned. In such cases, we may only use the data for certain limited purposes set out by the law.
  • Right to data portability: You may have the right to receive your personal data to which we have access, in a structured, commonly used and machine-readable format and you have the right transmit those data to another data controller.
  • Right to object:
You have the right to object to the processing of your personal data for any reason relating to your situation, and in this case, we may not be able to process your personal information. If you have the right to object and the exercise of this right is justified, your personal data in concern will not be further processed for the purposes of the objection.

You can contact the Hungarian National Data Protection and Freedom of Information Authority (Nemzeti Adatvédelmi és Információszabadság Hatóság – NAIH; seat: H-1055 Budapest, Falk Miksa str. 9-11.; website:; phone: +36-1-391-1400; email address:; fax: +36 1 391 1410).

Weitere InformationenDie Entwicklung Nr. GINOP-7.1.9-17 - 2018 - 00012 wird im vorrangigen Tourismusentwicklungsgebiet Balaton verwirklicht. Ziel des Projekts ist es, Entwicklungen im Bereich des Radsports für die gesamte Region umfassend umzusetzen und dabei sowohl Küsten- als auch Hintergrundsiedlungen im Blutkreislauf einzubeziehen.