Privacy Notice

1. Data controller

The controller is Mid Travel Betéti Társaság (short name: MID Travel Bt.), registered office: Délceg utca 11., 6727 Szeged, Hungary, company registration number: 06-06-017035, tax number: 26652085-2-06.

Privacy contact: midtravel2019@gmail.com, phone: +36 20 431 2094. Postal address: Délceg utca 11., 6727 Szeged, Hungary.

2. Data we process on this website

Account and sign-in: name, email address, phone number (if provided), password (stored hashed), session identifier, and the IP address and browser identifier linked to sign-in.

Contact form: name, email address, subject, message.

Trip application: name, email address, phone number, number of participants, selected trip, message, interest in travel insurance (checkbox), and optionally a travel companion’s name and phone number (so they can be seated together).

Booking and payment: the application data, booking amount and currency, payment status, Stripe payment identifiers, and — for invoicing — billing name, email, phone, tax number and billing address.

Technical data: IP address used for abuse prevention (temporary rate limiting) and, if error monitoring is enabled, technical logs that may include the time of the request, the page, and rarely part of data submitted in a form.

This website currently has no newsletter sign-up and no loyalty programme. We do not place marketing or analytics cookies (Google Analytics, Facebook Pixel).

3. Purposes and legal bases

Performance of a contract (GDPR Article 6(1)(b)): creating and managing an account, applications and bookings, deposit payment, performing the travel contract, and related communication.

Legal obligation (GDPR Article 6(1)(c)): issuing invoices and retaining accounting and tax records under Act C of 2000 on Accounting.

Legitimate interest (GDPR Article 6(1)(f)): secure operation of the website, preventing abuse and overload, and fixing errors. Our interest is to provide the service reliably; this does not override your privacy interests in a disproportionate way.

Consent (GDPR Article 6(1)(a)): accepting the privacy notice on the forms, and — if Sentry error monitoring is enabled — browser error reports. Withdrawing consent does not affect processing that was lawful before withdrawal, and does not end processing that remains necessary for the contract or a legal obligation.

4. Processors and recipients

To operate the website the controller uses the processors below. Personal data is disclosed only to the extent necessary.

Stripe (Stripe Payments Europe Limited and related Stripe group entities): card deposit payments via Stripe Checkout. The controller does not store card details; Stripe processes them.

Resend: delivery of emails related to bookings, applications, contact messages, password reset and email verification.

szamlazz.hu (KBOSS.hu Kft.): issuing invoices (including deposit invoices) in the buyer’s name, tax number and address.

Error monitoring: if Sentry is enabled, we may send technical data to Sentry’s operator to fix server-side operational errors. We send a browser error report only after you consent on the cookie banner.

Hosting and database: the website and data are stored on a server operated or commissioned by the controller. Tárhelypark Kft., named in the 2024 notice, is not a processor for this website.

To perform a trip — in line with the 2024 notice — we may disclose data to accommodation providers, carriers, local partners or authorities where this is necessary for the contract or by law. For destinations outside the EEA, data may also be transferred to a third country.

5. Retention

Contact messages: until the enquiry is answered, then for up to 2 years, unless a legal claim or statute requires longer retention.

Account data: until the account is deleted. After deletion we may keep data linked to a contract or invoice for statutory retention.

Applications, bookings, payments and invoices: 8 years for accounting records (Section 169 of the Accounting Act), and the period set in the 2024 notice for travel-contract data.

Session cookie: until the session expires, you sign out, or — if you leave “Remember me” unchecked — until you close the browser.

Security and error logs: for as long as needed for that purpose, typically a short period.

6. Transfers outside the EEA

Stripe, Resend and — if enabled — Sentry may also process data outside the European Economic Area (typically in the United States). Such transfers rely on appropriate safeguards under Chapter V of the GDPR (for example an adequacy decision of the European Commission or standard contractual clauses).

Depending on the destination, data needed to perform the contract may also be transferred outside the EEA. Point 4.3 of the 2024 notice also covers this.

8. Your rights

You may request access to your data, rectification, erasure or restriction of processing, object to processing based on legitimate interest, and — where processing is based on consent or a contract and is automated — exercise data portability. Section 5 of the 2024 privacy notice describes these rights in more detail.

Send requests to the email or postal address above. If you believe processing is unlawful, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9-11., ugyfelszolgalat@naih.hu, https://www.naih.hu, or go to court.

9. How this relates to the official documents

The privacy notice dated 1 January 2024 remains in force. This supplement describes the technical operation of this website (account, Stripe, Resend, szamlazz.hu, hosting, cookies). If this supplement and the 2024 notice differ on processing carried out on this website, this supplement prevails for this website.

The travel contract and general travel conditions are set out in the official 2025 document. A booking binds the parties to those terms.