Effective from: 17 August 2026
Oases Theme Hungary Travel Kft. places great importance on protecting the personal data of its customers, prospective customers, and visitors to the https://oasestravel.hu website.
The purpose of this Privacy Policy is to explain in a clear and transparent manner what personal data we process, for what purposes and on what legal basis, how long we retain such data, and what rights data subjects have in relation to the processing of their personal data.
In the course of data processing, we comply in particular with Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”) and Act CXII of 2011 on Informational Self-Determination and Freedom of Information (“Hungarian Privacy Act”).
1. Data Controller
Data Controller:
Oases Theme Hungary Travel Kft.
Full company name:
OASES THEME HUNGARY TRAVEL Utazási, Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság
Registered office:
1108 Budapest, Bányató utca 12. 9th floor, 38.
Contact address:
1101 Budapest, Kőbányi út 47/b.
Company registration number:
01-09-271794
Tax number / EU VAT number:
25380110-2-42 / HU25380110
Travel organiser licence number:
U-001684
Website:
https://oasestravel.hu
E-mail:
oasesthemehungarytravel@gmail.com
Telephone:
+36 70 419 8866
+36 30 294 6789
For the purposes of this Privacy Policy, Oases Theme Hungary Travel Kft. is hereinafter referred to as the “Data Controller.”
2. Principles of Data Processing
The Data Controller processes personal data:
- lawfully, fairly and transparently;
- only for specified, explicit and legitimate purposes;
- only to the extent necessary for the purposes of processing;
- while taking reasonable steps to ensure that the data are accurate and up to date;
- only for as long as necessary;
- using appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.
3. Data Processed When Visiting the Website
When visiting https://oasestravel.hu, the web server may automatically record certain technical information.
This may include:
- IP address;
- date and time of the visit;
- pages visited;
- browser type and version;
- operating system;
- device information;
- referring website;
- technical log data.
Purpose of processing:
To ensure the proper and secure operation of the website, detect technical errors, maintain IT security and prevent misuse.
Legal basis:
Article 6(1)(f) GDPR – legitimate interests of the Data Controller.
Retention period:
Technical log data are retained only for as long as necessary for operational and security purposes, unless a security incident or legal claim requires longer retention.
4. Contact Requests and General Enquiries
When contacting the Data Controller through the website, by e-mail, by telephone or through another communication channel, the Data Controller may process the following personal data:
- name;
- e-mail address;
- telephone number;
- content of the message;
- subject of the enquiry;
- travel-related information voluntarily provided by the data subject;
- date and time of contact.
Purpose of processing:
To respond to enquiries, maintain communication, provide information about services and, where applicable, prepare for the conclusion of a contract.
Legal basis:
Article 6(1)(b) GDPR where processing is necessary to take steps at the request of the data subject prior to entering into a contract, and Article 6(1)(f) GDPR for other general enquiries based on the legitimate interests of the Data Controller.
Retention period:
If the enquiry does not lead to the conclusion of a contract, the data will generally be retained for no longer than 1 year after the enquiry has been closed, unless a legal claim or legal obligation requires longer retention.
5. Requests for Individual Quotations and Travel Consultations
OASES Travel provides consultations and individual quotation services in relation to travel to China, cultural and sightseeing tours, business travel, exhibitions, professional programmes and tailor-made travel arrangements.
For the preparation of an individual quotation, the Data Controller may process:
- name;
- contact details;
- planned travel dates;
- destination;
- number of travellers;
- requested services;
- accommodation preferences;
- information relating to business or leisure programmes;
- other information voluntarily provided by the customer.
Purpose of processing:
To prepare a personalised quotation, design a travel programme, provide consultation and prepare for the conclusion of a contract.
Legal basis:
Article 6(1)(b) GDPR – taking steps at the request of the data subject prior to entering into a contract.
Retention period:
If no contract is concluded based on the quotation, the data will generally be retained for no longer than 1 year from the expiry of the quotation or the end of the consultation process.
If a contract is concluded, the data will continue to be processed for the performance of the contract and compliance with applicable legal obligations.
6. Processing Related to the Performance of Travel Services
When a travel service is booked, the Data Controller may process personal data necessary for organising and providing the travel service.
Such data may include:
- full name;
- home address;
- e-mail address;
- telephone number;
- date and place of birth;
- nationality;
- passport details;
- information required for visa arrangements;
- travel dates;
- flight and transportation details;
- accommodation details;
- billing information;
- other data necessary for the provision of the travel service.
Purpose of processing:
To perform the travel contract, make reservations, arrange transportation, accommodation, guide services and other travel-related services.
Legal basis:
Article 6(1)(b) GDPR – performance of a contract.
Where processing is required to comply with a legal obligation, the legal basis is Article 6(1)(c) GDPR.
7. Passport, Visa and Other Travel Documents
For certain travel services to China, it may be necessary to process passport details or data contained in other official travel documents.
The Data Controller requests and processes such data only where strictly necessary for the provision of the relevant service.
Where required, such data may be disclosed to parties involved in arranging the journey, including in particular:
- airlines;
- accommodation providers;
- local tour operators;
- transfer providers;
- organisations assisting with visa procedures;
- public authorities.
Any disclosure of personal data is limited to the data necessary for the provision of the relevant service.
8. Special Categories of Personal Data
During the organisation of a journey, the customer may voluntarily provide information that qualifies as special category personal data, such as:
- health-related information;
- food allergies;
- special dietary requirements;
- information relating to reduced mobility or other special assistance needs.
The Data Controller processes such data only where this is necessary for the proper and safe provision of the travel service and where an appropriate legal basis exists.
Customers should provide only such health-related or other sensitive information as is genuinely necessary for the organisation of the journey.
9. Billing and Accounting Data
When a service is purchased, the Data Controller processes data necessary for billing and accounting purposes.
Such data may include:
- name or company name;
- home address or registered office;
- tax number, where applicable;
- billing details;
- information relating to the service and payment.
Purpose of processing:
To issue invoices and comply with accounting and tax obligations.
Legal basis:
Article 6(1)(c) GDPR – compliance with a legal obligation.
Retention period:
For the period required by the applicable Hungarian accounting and tax legislation.
10. E-mail and Telephone Communication
Communication with customers and prospective customers may take place by e-mail or telephone.
Personal data provided during such communication are used only for handling the relevant enquiry, preparing quotations, arranging travel services or managing an existing customer relationship.
Telephone calls are not generally recorded by the Data Controller.
11. Social Media
OASES Travel may operate social media pages, including Facebook and YouTube.
If a data subject contacts the Data Controller through such platforms, the privacy rules of the relevant platform also apply.
The providers of social media platforms may process users’ personal data as independent data controllers.
The Data Controller does not have full control over the processing activities carried out by such social media providers.
12. Embedded Third-Party Content
Certain pages of the website may contain content provided by third parties, such as videos, maps or social media elements.
When such content is loaded, the relevant third-party provider may receive technical data such as:
- IP address;
- browser information;
- cookie-related information.
Where prior consent is required for loading such third-party content, it will only be loaded after the user has given the necessary consent.
13. Cookies
The website may use cookies and similar technologies.
A cookie is a small data file stored on the visitor’s device by the website.
13.1 Strictly Necessary Cookies
These cookies are necessary for the proper functioning, security and basic functionality of the website.
No separate consent is required for the use of strictly necessary cookies.
13.2 Statistical and Analytical Cookies
If the website uses statistical or analytical services, these may help the Data Controller understand how visitors use the website.
Where required by law, such non-essential cookies are used only with the visitor’s prior consent.
13.3 Marketing Cookies
If the website uses marketing, advertising or conversion-tracking technologies, such technologies are used only on the basis of appropriate prior consent.
Visitors must be given the opportunity to accept or reject non-essential cookies and to withdraw their consent at a later time.
A detailed list of the cookies actually used on the website may be provided through the website’s cookie settings interface or in a separate Cookie Policy.
14. Data Processors and Recipients
The Data Controller may use data processors and other service providers in order to provide its services.
These may include, in particular:
- website hosting and server service provider;
- website maintenance provider;
- IT service provider;
- e-mail service provider;
- accountant and invoicing service provider;
- accommodation providers;
- airlines;
- transportation or transfer providers;
- Chinese or other local tour operator partners;
- tour guides;
- event and exhibition partners;
- visa assistance providers;
- other service providers necessary for the performance of a specific journey.
Website Hosting and Server Service Provider
Sybell Informatika Kft.
Registered office:
1138 Budapest, Tomori utca 34. 2nd floor
Company registration number:
01-09-293034
Tax number:
25859502-2-41
E-mail:
info@sybell.hu
Website:
https://sybell.hu
Purpose of data processing:
Provision of website hosting, server-side operation and related IT infrastructure necessary for the availability and operation of the website.
The Data Controller only transfers or makes available to processors and recipients the personal data necessary for the performance of the relevant service.
15. Transfers of Personal Data Outside the European Economic Area
As one of the main activities of OASES Travel is the organisation of travel and related services to China, the performance of certain services may require the transfer of personal data to service providers located in the People’s Republic of China.
Such recipients may include, for example:
- local tour operators;
- hotels;
- transportation providers;
- tour guides;
- event organisers;
- local partners involved in business or professional programmes.
Personal data are transferred only to the extent necessary for arranging and providing the relevant journey or service.
The Data Controller handles transfers of personal data outside the European Economic Area in accordance with Chapter V of the GDPR and, where necessary, applies appropriate safeguards for international data transfers.
Where the explicit consent of the data subject is required for a particular international transfer, the Data Controller will provide appropriate information before the transfer takes place.
16. Automated Decision-Making and Profiling
As a general rule, the Data Controller does not carry out solely automated decision-making or profiling in connection with its travel services where such processing would produce legal effects concerning the data subject or similarly significantly affect them.
17. Data Security
The Data Controller implements appropriate technical and organisational measures to protect personal data.
In particular, the Data Controller seeks to:
- restrict access to personal data;
- prevent unauthorised access;
- ensure appropriate protection of IT systems;
- reduce the risk of data loss or data leakage;
- ensure that personal data are accessible only to persons who require such access for the performance of their duties.
18. Rights of Data Subjects
Under the GDPR, data subjects have, in particular, the following rights:
Right of Access
The data subject may request confirmation as to whether the Data Controller processes their personal data and may request access to such data.
Right to Rectification
The data subject may request the correction of inaccurate personal data and the completion of incomplete personal data.
Right to Erasure
In the cases specified by law, the data subject may request the deletion of their personal data.
Right to Restriction of Processing
The data subject may request restriction of processing where the conditions set out in the GDPR are met.
Right to Data Portability
Where processing is based on consent or contract and is carried out by automated means, the data subject may have the right to receive the personal data they have provided in a structured, commonly used and machine-readable format.
Right to Object
Where processing is based on legitimate interests, the data subject has the right to object, on grounds relating to their particular situation, to the processing of their personal data.
Withdrawal of Consent
Where processing is based on consent, the data subject may withdraw their consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
19. Submission of Data Subject Requests
Requests or complaints relating to the processing of personal data may be submitted using the following contact details:
Oases Theme Hungary Travel Kft.
E-mail:
oasesthemehungarytravel@gmail.com
Postal address:
1108 Budapest, Bányató utca 12. 9th floor, 38.
The Data Controller will respond to data subject requests in accordance with the GDPR, generally within one month of receipt of the request.
20. Complaint to the Supervisory Authority
If a data subject believes that the processing of their personal data infringes applicable data protection law, they may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information.
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Address:
1055 Budapest, Falk Miksa utca 9–11.
Postal address:
1363 Budapest, Pf. 9.
Telephone:
+36 1 391 1400
Website:
https://www.naih.hu
The data subject also has the right to seek judicial remedy in accordance with the GDPR and applicable Hungarian law.
21. Amendments to this Privacy Policy
The Data Controller reserves the right to amend this Privacy Policy where necessary due to changes in legislation, the operation of the website or the Data Controller’s data processing practices.
The current version of this Privacy Policy will always be available on the https://oasestravel.hu website.
Where appropriate, data subjects will be informed of material changes in an appropriate manner.
Oases Theme Hungary Travel Kft.
Budapest, 17 August 2026