Privacy Notice

In short: this website sets no cookies, does not measure its visitors, and passes no data to advertising systems. Personal data reaches me in one way only: if you fill in the contact form, or write or call me. I use what you send solely to reply and — should you decide so — to handle your property transaction.

1. Who processes your data

Controller: Karner Péter Nándor E.V. (sole trader, Hungary)
Registered seat: 1021 Budapest, Alsó Völgy utca 14/A, Hungary
Tax number: 68237039-1-41
Registration number: 51449166
E-mail: hello@flatmaningatlan.hu
Phone: +36 20 926 0345

I am not required to appoint a data protection officer and have not appointed one: the processing involves neither regular large-scale monitoring nor special categories of data at scale. Please address any data protection question to me directly.

2. What data I process, why, and for how long

2.1. Getting in touch (form, e-mail, phone)

Data: name, e-mail address, phone number (optional), the text of your message, and the page address you sent the form from.
Purpose: answering your enquiry, arranging viewings, making offers, and keeping continuity in later correspondence.
Legal basis: steps taken at your request prior to entering into a contract (GDPR Article 6(1)(b)). Where the enquiry is unrelated to a transaction, the basis is your consent (Article 6(1)(a)), which you may withdraw at any time.
Retention: 2 years from our last substantive contact, so that a returning enquiry need not start from scratch. On an earlier erasure request I delete without delay, except what accounting law requires me to keep.
If you provide nothing: without a name, an e-mail address and a message I cannot reply. Providing them is not a statutory obligation, but it is a precondition of contact.

2.2. Performing an engagement

Data: the data contained in the agency agreement, the property record and the documents belonging to the transaction.
Purpose and legal basis: performance of the contract (Article 6(1)(b)) and compliance with legal obligations (Article 6(1)(c)) under accounting and anti-money-laundering rules.
Retention: accounting records for 8 years under Act C of 2000 on Accounting; customer due diligence records for 8 years from the end of the business relationship under the Hungarian anti-money-laundering act. Other documents for 5 years from termination, following the general limitation period.

2.3. Abuse protection on the form

Data: an irreversible fingerprint derived from your IP address, and the number of submissions.
Purpose: preventing automated bulk submissions.
Legal basis: legitimate interest (Article 6(1)(f)) in keeping the form usable. Balancing test: the value cannot identify you and exists for a very short time, so the effect on your rights is negligible.
Retention: 1 minute, after which it is deleted automatically.

2.4. Protection against password guessing

This section concerns the site’s editing interface, not its visitors. If you only read the site, it does not affect you.

Data processed: an irreversible fingerprint derived from the IP address attempting to sign in, and the number of failed attempts. The IP address itself is not stored, and it cannot be recovered from the fingerprint.
Purpose: to prevent automated guessing of the password. After five failed attempts, no further attempt is accepted from that address for a while.
Legal basis: legitimate interest (GDPR Art. 6(1)(f)) in protecting the site and the enquiries stored in it. Balancing test: the data cannot identify anyone, arises only on a failed sign-in, and expires by itself shortly afterwards.
Retention: at most 20 minutes, after which it is deleted automatically.

2.5. Server logs

Data: to operate the site, the hosting provider’s system logs request times, requested addresses, IP addresses and browser identifiers.
Purpose and legal basis: operation, troubleshooting and IT security — legitimate interest (Article 6(1)(f)).
Retention: as set out in the hosting provider’s own policy (typically no more than 30 days).

3. What I do not do

I use no analytics, statistics or advertising cookies, and build no visitor profiles.
I send no newsletter and keep no mailing list.
I neither sell nor rent personal data to anyone.
I take no automated decisions about you and carry out no profiling.
I neither request nor process special categories of data (health, religious, political and similar).

4. Who may access your data

Access is primarily mine. Besides me, the following processors act, strictly within the task indicated:

Hosting provider — Tárhely.Eu Szolgáltató Kft. (Ormánság utca 4, floor X/241, 1144 Budapest, Hungary; gdpr@tarhely.eu): operating the website and the mailboxes. Data is stored on servers in Hungary, within the European Union.
Accountant: processing accounting records to meet statutory obligations.
Website developer and maintainer — Karner Kristóf e.v. (registration number: 59509570, kristof@kristofkarner.com): development, updates and operational support for the site. Maintenance may involve access to data stored on the server, used solely for the technical task at hand.

Beyond this I disclose data only where law obliges me to (for instance an official request), or where you expressly ask me to (for instance towards the other party in a transaction).

5. Embedded content: maps and video

Property pages offer a map, and some listings a video. These do not load automatically: until you click to display them, the site sends no request to Google or YouTube, and no data leaves the page.

If you display the map or start the video, the provider acts under its own rules and receives your IP address and browser details. Video is served from youtube-nocookie.com, which sets no tracking cookie before playback. These services belong to a company operating in the United States; the transfer relies on the EU–US Data Privacy Framework.

Google privacy policy: policies.google.com/privacy

6. Your rights

Under the GDPR you have the rights below. You may exercise any of them free of charge using the contact details above. I reply within one month at the latest; in complex cases this may be extended by two months, of which I will inform you.

Access: you may ask whether I process your data and, if so, request a copy.
Rectification: you may ask for inaccurate data to be corrected and incomplete data completed.
Erasure: you may ask for your data to be deleted where it is no longer needed, where you withdraw consent, or where processing is unlawful. Erasure does not extend to data I am legally obliged to retain.
Restriction: you may ask me to store your data but otherwise not process it — for example while you contest its accuracy.
Portability: data processed by automated means on the basis of consent or contract can be provided in a structured, machine-readable format.
Objection: you may object to processing based on legitimate interest; I will then stop, unless compelling legitimate grounds require otherwise.
Withdrawal of consent: you may withdraw consent at any time. This does not affect the lawfulness of processing before withdrawal.

7. Security

The site is served over an encrypted connection (HTTPS). Incoming enquiries are stored behind a password-protected interface accessible only to me. Systems and credentials are kept current. In the event of a personal data breach likely to result in a risk to your rights, I notify the authority within 72 hours and inform you where required.

8. Remedies

If you believe your rights have been infringed, please contact me first — most questions are resolved fastest that way. Regardless, you may lodge a complaint with the supervisory authority or bring court proceedings.

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Falk Miksa utca 9-11, 1055 Budapest, Hungary
Postal address: 1363 Budapest, Pf. 9
Phone: +36 1 391 1400 · E-mail: ugyfelszolgalat@naih.hu · naih.hu
Courts: you may also bring proceedings before the regional court of your place of residence or stay.

9. Changes to this notice

I update this notice when the operation of the site or the legal environment changes. The version in force is always available at this address; I announce material changes on the website.

Website developed and maintained by Karner Kristóf e.v. · registration number: 59509570 · kristof@kristofkarner.com

In force from: 15 August 2026