Incident Response and Data Subject Requests

1. What qualifies as a personal data breach?

Under Article 4(12) of the GDPR, a personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

Examples that may qualify as an incident:

• Unauthorized access to the Bokko database
• Accidental deletion or corruption of guest data
• Accidental disclosure of booking data to a third party
• A security event at a sub-processor that affects Bokko data
• Contact between malware or ransomware and live data

2. Incident response process

Internal steps

1. Detection and containment: after identifying the incident, we immediately start minimizing the impact — suspending access, isolating the affected component.
2. Investigation and assessment: we determine the type of incident, the scope and categories of data affected, the approximate number of data subjects affected, and the likely risk to data subjects.
3. Documentation: we keep an internal record of every incident — including non-notifiable events — pursuant to Article 33(5) of the GDPR.
4. Notification to the supervisory authority (where Bokko acts as data controller): if the incident poses a risk to data subjects and Bokko has acted as an independent data controller (e.g., subscriber platform accounts), we will notify the NAIH without undue delay and, where feasible, not later than 72 hours after becoming aware of the incident; where the notification is made later, we also give the reasons for the delay. Where Bokko acted as a data processor (guest booking data), we will notify the subscriber without undue delay — see Section 3.
5. Notification to data subjects (where required): where Bokko acted as an independent controller and the incident poses a high risk to data subjects, we will notify them directly. For an incident affecting guest booking data, the provider as controller decides on notifying the data subjects; Bokko assists at the provider's request.
6. Recovery and follow-up: remediation of the root cause and, where necessary, improvement of processes.

Threshold for notification to the supervisory authority

Under Article 33 of the GDPR there is a notification obligation unless the incident is unlikely to result in a risk to the rights and freedoms of natural persons. Risk-free incidents are also documented but not notified.

3. Notification obligations

Notifying subscribers (data controllers)

Subscribers act as data controllers in respect of their guests' data; Bokko acts as data processor. Under Article 33(2) of the GDPR, the processor is required to notify the controller without undue delay of any personal data breach.

Bokko notifies the affected subscribers about the incident at their registered email address, providing the following information:

• The nature of the incident and its approximate time
• The categories of data affected and the number of data subjects (if known)
• The likely consequences
• Measures taken or planned
• Contact point for further information

Notification to the supervisory authority

The competent supervisory authority is the NAIH (Hungarian National Authority for Data Protection and Freedom of Information). Website: naih.hu.

Role allocation: For incidents affecting guest booking data, notifying the NAIH is the obligation of the data controller (the subscriber) (Article 33 GDPR). As a data processor, Bokko notifies the subscriber without undue delay so that the subscriber can make the notification to the supervisory authority within the 72-hour deadline.

4. Data subject requests (DSAR)

If you, as an end user (guest) or as a subscriber, wish to submit a request regarding your personal data, please follow the guidance below.

Where to write

Data subject requests can be sent to support@bokko.app. As a guest, you can also request anonymisation of your booking data at all businesses at once, self-service, in the booking.bokko.app/hu/adataim portal.

Identification

To fulfill a request we need to verify that the person submitting the request is the one whose data the request relates to. To this end we may ask for:

• Confirmation of the email address provided in the request (confirmation email)
• An identifier linked to the booking or account (if available)
• An official identity document only if identity cannot be established by other means

Deadlines

The deadlines below apply to requests that Bokko fulfils within its own processing (for example provider account data).

Scope — guests vs. subscribers

Bokko processes guest data as a data processor on behalf of the subscriber. If you submit a request as a guest by email, we forward it without undue delay to the relevant subscriber (provider), as the provider is the controller (Data Processing Agreement Section 10); the deadline for fulfilling the request then rests with the provider, and Bokko provides technical assistance. Anonymisation requested in the portal is carried out by Bokko itself on the basis of the providers' prior general instruction. Where Bokko processes your data as a controller in its own right (e.g., a registered subscriber's account), we will fulfill the request directly.

5. Summary of data subject rights

Detailed description: Privacy Policy

6. Contact

Data subject requests, incident reports, and privacy-related questions: support@bokko.app

Supervisory authority: NAIH — naih.hu