The imagine.hu, imaginebp.hu, imaginepecs.hu, imagineeger.hu, imagineveszprem.hu, imaginedebrecen.hu, imaginebudapest.hu, varosiseta.hu, tematikusseta.hu, tematikussetak.hu, imaginewalks.hu and imaginewalks.com websites are operated by Sétapálca Kft.

Our company pays particular attention to ensuring that, in the course of processing personal data, it acts in compliance with the applicable data protection legislation. Please read this Notice carefully in order to understand how we process your personal data and what rights you have in relation to such processing.

A more detailed description of the matters set out in this Notice can be found in our company’s Data Processing Policy.

1. The Data Controller

Sétapálca Kft. (Registered office: 1124 Budapest, Kiss János altb. utca 55., Building 3, 1st floor, Door 34; Business premises: 1092 Budapest, Ráday utca 30., ground floor; Tax number: 24114413-2-43; Company registration number: 01-09-377633) For data protection matters, please contact: Márton Káldi, Managing Director (info@imagine.hu)

2. Scope of the Data Processed

The Data Controller operates a video surveillance system at its business premises for property protection purposes. Sétapálca Kft. processes personal data in the course of the following data processing activities:

• use of the website and management of cookies;
• registration and management of user accounts;
• operation of the loyalty customer programme;
• requests for quotations and use of services;
• purchase of gift vouchers;
• purchase and postal delivery of physical products (gift items);
• sending newsletters;
• management of user reviews;
• operation of the video surveillance system at the business premises.

When viewing the website, certain data are automatically recorded for technical operational reasons, including the start and end time of the user’s visit and, in some cases — depending on the settings of the user’s computer — information about the browser and operating system, the user’s IP address, and the name of the website from which the user arrived. The system automatically generates statistical data from this information. The operator does not link these data with other personal data and uses them exclusively for the preparation of statistics. The website sends cookies to visitors’ computers.

We process the email addresses and names provided voluntarily on the website on the basis of consent, as well as information related to which tours the user has previously attended and the value of their purchases (for the purpose of determining eligibility for loyalty customer benefits). When a name is provided, the user may choose what name to enter or use for registration.

3. Purpose of Data Processing

The recording and storage of the time of the visit, the IP address, and browser and operating system data are inherent features of the operation of the system. The processing of these data is technically essential and is carried out exclusively for statistical purposes.

When requesting a quotation for participation in a tour, the provision of the name, email address and language as personal data is required, along with further information that does not qualify as personal data (the number of participants and the planned date).

When registering a user account or purchasing a service or gift voucher, the name, email address and telephone number, as well as the billing name and address, must be provided on the website. In the case of ordering a physical product (gift item) with postal delivery, the delivery address must also be provided in addition to the above.

When subscribing to the newsletter service, the provision of a name and email address is required.

By providing their data, users consent to our company processing their personal data. The processing of data provided for the use of the website is carried out on the basis of the user’s voluntary consent, with knowledge of the information contained in this Notice.

A video surveillance system operates at the business premises of Sétapálca Kft. for property protection purposes. The cameras monitor only the customer area, the entrance and the common areas. The purpose of camera surveillance is to protect property, to protect human life and physical integrity, and to prevent and detect infringements. The legal basis for the processing is legitimate interest pursuant to Article 6(1)(f) of the GDPR.

4. Duration of Data Processing

Session IDs are automatically deleted when the browser is closed. Users may delete their own cookies at any time.

The data of users using the service are retained until the expiry of the general limitation period, i.e. for 5 years. Data provided for the use of the newsletter service are retained until the user unsubscribes from the service.

Our company strives to provide its loyalty customers with the greatest possible benefits. The data of participants in the loyalty customer programme are deleted no later than within 365 days from the date on which the customer’s participation in the programme, or the programme itself, is terminated.

Personal data relating to gift vouchers are retained for statistical purposes for 5 years after redemption/use.

Recordings made by the video surveillance system operating at the business premises of Sétapálca Kft. are retained for 30 days, after which they are automatically deleted. If a recording is required as evidence of an infringement or incident, it may be retained for the period necessary to enforce a legal claim.

5. Persons with Access to the Data; Data Processors

The personal data provided by users, as well as the data automatically obtained as a result of the technical operation of the system, may be accessed by the company’s managing director and by internal employees specifically authorised for this purpose by the management (including project managers and customer service staff). The Data Controller does not publish the data and discloses them to third parties only where an appropriate legal basis is available.

In connection with the operation of the IT system, the fulfilment of orders, the delivery of physical products and the settlement of accounting matters, the Data Controller may use data processors. The selection and use of data processors are carried out in accordance with Article 28 of the GDPR. The third parties carrying out data processing are:

• Meyer & Levinson Kft. (the company providing accounting services to the Data Controller),
• KBOSS.hu Kereskedelmi és Szolgáltató Kft. (the operator of számlázz.hu),
• Riport Application Kft. (the operator of the Data Controller’s financial back-office system),
• Péter Szirmai, sole entrepreneur (the IT developer of the Data Controller),
• Mailjet Inc. and the Sinch Group company (the operators of the Data Controller’s newsletter sending system),
• Barion Payment Zrt. (the operator of the online payment system),
• Magyar Posta Zrt. (the logistics partner for physical products),
• and the Data Controller’s bank(s) maintaining its bank account at any given time.

6. Rights of Users

The data subject may request the following from the Data Controller:

• information about the processing of their personal data,
• rectification of their personal data,
• erasure of their personal data, except where data processing is mandatory,
• restriction of data processing,
• object to data processing,
• data portability.

Upon the request of the data subject, the Data Controller shall provide information on the data subject’s data processed by the Data Controller, as well as on the data processed by any data processor engaged by the Data Controller or on its instructions, including the source of such data, the purpose, legal basis and duration of the processing, the name and address of the data processor and its activities related to the processing, the circumstances and effects of any personal data breach and the measures taken to remedy it, and — where the data subject’s personal data have been transferred — the legal basis and recipient of such transfer.

The Data Controller shall respond to requests within 30 days at the latest.

7. Data Security

Our company makes every effort, with particular care, to ensure the secure processing of data, and therefore takes the technical and organisational measures necessary to ensure compliance with data protection rules. For this purpose, our company uses only legally licensed software, updates it regularly, and employs a qualified IT professional. Up-to-date antivirus and security software has been installed on our computers. We use passwords of appropriate complexity on all technical devices connected with the business.

8. Remedies

In the event of an infringement, you may seek legal remedy by contacting the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) (ugyfelszolgalat@naih.hu; http://naih.hu; 1530 Budapest, P.O. Box 5; +36 1 391 1400).

9. Reservation

The Data Controller reserves the right to unilaterally amend this Notice and the underlying Data Protection Policy in accordance with the applicable legislation.

Budapest, 1 April 2026.

Sétapálca Kft.