Privacy Notice
Effective from: 1 October 2026. Last amended: 28 September 2026.
This notice explains what personal data we process when you use lakasberles.hu, why, for how long, and what rights you have. Data processing takes place in accordance with the General Data Protection Regulation of the European Union (GDPR, 2016/679/EU) and Act CXII of 2011 on informational self-determination (Infotv.).
1. The data controller
Beauty Warehouse Kft.
Registered seat: 2533 Bajót, Katona József utca 9.
Tax number: 25808630-2-11
Company registration number: [TO BE COMPLETED]
E-mail (also for data protection matters): hello@lakasberles.hu
We are not required to appoint a data protection officer.
2. How do we protect your data?
- We store personal data (name, e-mail, phone number, exact address, messages, tenant profile, contracts, billing data) encrypted in the database; we search for the e-mail address only by an irreversible hash.
- Every connection is encrypted (HTTPS). Passwords are stored only in an irreversible form.
- Two-factor authentication is available to everyone and mandatory for administrators.
- We record important events (login, payment, consent, signature) in a chained-hash log that cannot subsequently be altered.
3. What data do we process, why, and for how long?
| Processing activity | Data processed | Legal basis | Retention period |
|---|---|---|---|
| Registration, user account | name, e-mail, phone number (optional), password hash, account type, profile picture, two-factor authentication secret, last login, language | performance of a contract (GDPR Article 6(1)(b)) | until the account is deleted |
| Listings | the listing's data, photos, address (the exact address is displayed only if the advertiser chooses), contact person's name and phone number | performance of a contract (Article 6(1)(b)) | for 12 months after expiry, archiving or deletion, then permanent deletion |
| Sending a message without registration (enquiry) | name, e-mail, phone number (optional), message, IP address | contacting the advertiser at your request (Article 6(1)(b)) | 24 months |
| Messaging between registered users, appointment booking | messages, booked appointment, phone number (if provided) | performance of a contract (Article 6(1)(b)) | 24 months from the last message |
| Favourites, saved searches, notifications | liked listings, search criteria, notification frequency | performance of a contract (Article 6(1)(b)) | until you delete it, or until the account is deleted |
| Tenant profile | introduction, occupation, income band, household, pets, smoking, moving date, budget | consent (Article 6(1)(a)) – sharing the profile is voluntary and can be switched off at any time | until you delete it, or until the account is deleted |
| "Verified tenant" certificate | uploaded employer, income or student certificate | consent (Article 6(1)(a)) | the document is deleted immediately after assessment, at the latest after 30 days; only the result (accepted/rejected, date) is retained |
| Agency CRM | assignment of enquirers, status, internal notes | the agency's legitimate interest (Article 6(1)(f)); in this respect the agency is an independent controller, and we store the data on its behalf | until the enquiry is deleted (see above) |
| Contract generator, handover protocol | personal data of the parties, data on the property and the tenancy, photos, signature image or typed name, time of signing, IP address, browser type | performance of a contract (Article 6(1)(b)) and the establishment of legal claims – legitimate interest (Article 6(1)(f)) | draft: 12 months; signed or withdrawn document: 6 years (due to the 5-year civil-law limitation period), even if the account is deleted |
| Payment and invoicing | billing name, address, tax number (for companies), order data, payment identifier | legal obligation (Article 6(1)(c)) – Section 169 of Act C of 2000 on Accounting | 8 years |
| Newsletter | e-mail address, source and time of subscription, time of confirmation | consent (Article 6(1)(a)) | until unsubscription; proof of consent is kept in the log (see below) |
| Cookies and consents | see the Cookie Policy; regarding consent: decision, time, IP address, browser, hash of the text displayed | consent (Article 6(1)(a)), and for proof of consent: legal obligation (Article 7(1)) | 5 years |
| Security and event log | user identifier, event, IP address, browser, time | legitimate interest (Article 6(1)(f)): preventing abuse, evidence | 5 years |
| Fraud screening, moderation | the listing's text and a hash of its photos, reports | legitimate interest (Article 6(1)(f)) and the obligation under the DSA (Article 6(1)(c)) | together with the listing; closed reports for 24 months |
| Error log | the location and time of the error, request data (may include IP address) | legitimate interest (Article 6(1)(f)): operating the service | 90 days from resolution of the error |
| Reviews (only after a lease signed on the platform) | star rating, written review, reply; publicly only first name and initial of the surname | legitimate interest (Article 6(1)(f)): a trustworthy rental market | as long as the account of the reviewer or the reviewed person exists |
| Phone number verification | phone number, time of verification | consent (Article 6(1)(a)) | until the account is deleted; the SMS code is deleted after 10 minutes |
| Customer support | name, e-mail, your question and our replies | performance of contract and legitimate interest (Article 6(1)(b), (f)) | 24 months after the ticket is closed |
| Commute-time search | the destination (address) you enter | fulfilling your request (Article 6(1)(b)) | the coordinates are cached, keyed by a one-way hash and encrypted, for at most 1 month |
| Banner advertising | advertiser's name, banner content, landing page, impression and click counts (no personal data) | performance of contract (Article 6(1)(b)) | 8 years after the campaign ends, together with the accounting records |
| Data export request | the downloadable ZIP file | legal obligation (Article 6(1)(c)) | 1 day |
Automated decision-making: the fraud filter may automatically flag suspicious listings, but a staff member always decides on rejecting a listing or suspending an account (there is no decision based solely on automated processing within the meaning of GDPR Article 22).
If you do not provide the mandatory data, registration or the relevant service cannot be used.
4. Who can access your data?
Other users: anyone can see the public data of a listing; your messages and (if you allow it) your tenant profile are seen only by the person you write to; the contract and protocol are seen only by the parties named in them.
Our processors and independent controller partners:
| Partner | Task | Data transferred |
|---|---|---|
| [TO BE COMPLETED: hosting provider] | server, hosting | all data stored on the Platform (encrypted) |
| [TO BE COMPLETED: e-mail delivery provider] | delivery of system messages and the newsletter | name, e-mail, the content of the message |
| Barion Payment Zrt. (1117 Budapest, Irinyi József u. 4–20.) – independent controller | card payment, recurring charges, fraud prevention (Barion Pixel) | name, e-mail, order data, browsing data via the Barion Pixel |
| Billingo Technologies Zrt. | issuing and delivering invoices | billing name, address, tax number, e-mail, order data |
| OpenFreeMap (map tiles) | displaying the map | your browser's IP address when map tiles are downloaded (does not use cookies) |
| OpenStreetMap Foundation – Nominatim (United Kingdom) | address-to-coordinate conversion when submitting a listing | only the address entered, from our server (not your IP address) |
| [TO BE COMPLETED, if enabled: SMS provider (e.g. SeeMe / Twilio)] | delivery of verification SMS | phone number, SMS text |
| Meta Platforms Ireland Ltd. (if enabled) | sharing new listings on the Lakásbérlés.hu Facebook page | the public data of the listing (title, price, photo, link) – not the advertiser's personal data |
| Cloudflare, Inc. – Turnstile (if enabled) | bot filtering on forms | IP address, browser characteristics |
| Anthropic PBC (if enabled) | AI listing-description writer, checking text for suspected fraud | the listing's text and data; we do not send personal data |
For partners outside the European Economic Area (United Kingdom, United States), data transfers take place on the basis of a European Commission adequacy decision (United Kingdom; EU–US Data Privacy Framework) or standard contractual clauses (SCCs).
We disclose data to an authority or court only where required by law, upon request.
5. Your rights
- Access and data portability (Articles 15 and 20): under My account → Privacy you can download all your data with a single click (in JSON format).
- Rectification (Article 16): you can amend your data in the Profile menu.
- Erasure (Article 17): you can delete your account under My account → Privacy. We retain billing data and signed contracts for the periods set out above, as required by law or for the establishment of legal claims (Article 17(3)(b) and (e)).
- Restriction and objection (Articles 18 and 21): you may object at any time to processing based on legitimate interest.
- Withdrawal of consent: for the newsletter, at the bottom of any e-mail; for cookies, via the "Cookie settings" link in the footer; for sharing your tenant profile, on the profile page. Withdrawal does not affect the lawfulness of processing carried out before it.
We respond to your request within one month (hello@lakasberles.hu); where justified, this may be extended by a further two months.
6. Legal remedies
You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; phone: +36 1 391 1400; e-mail: ugyfelszolgalat@naih.hu; www.naih.hu. You may also turn to the courts; you may bring proceedings before the regional court (törvényszék) having jurisdiction over your place of residence or stay.
7. Data breach
If the security of personal data is breached, we report it to the authority within 72 hours, and if the breach is likely to result in a high risk to you, we also inform you without undue delay.
8. Amendment
We adapt this notice to changes in the service; we notify you of material changes by e-mail and on the Platform.