Legal

Privacy Policy

Effective: 31 July 2026

Data controller

O.K. CAR Kft.

Registered seat: 1029 Budapest, Zsíróshegyi út 100.

Company registration no.: 01-09-567550

Tax number: 12235058-1-41

myhome@olahkrisztina.hu+36 30 941 4510

Data protection contact: —

1. Data processing statement

This privacy policy (the “Policy”) sets out how the operator of the My Home Budapest website (the “Website”), the Data Controller, processes personal data. When you use our services, you provide us with personal data. We handle this data with the utmost care, in accordance with applicable law, and always strive to meet your expectations regarding data processing. We treat the protection of your data against unauthorised access as a matter of high importance. The legislation governing our data processing activities includes in particular:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation — GDPR)
  • Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (Hungary)
  • The Fundamental Law of Hungary
  • Act V of 2013 on the Civil Code (Hungary)
  • Act C of 2003 on Electronic Communications (Hungary)
  • Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (Hungary)
  • Act CL of 2017 on the Rules of Taxation (Hungary)
  • Act C of 2000 on Accounting (Hungary)
  • Act CLV of 1997 on Consumer Protection (Hungary)
  • Act XLVIII of 2008 on the Basic Conditions and Certain Restrictions of Commercial Advertising Activities (Hungary)

2. Definitions

  • GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
  • Personal data: any information relating to an identified or identifiable natural person.
  • Processing: any operation performed on personal data, such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, restriction, erasure or destruction.
  • Controller: the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • Processor: a natural or legal person which processes personal data on behalf of the controller.
  • Data subject: an identified or identifiable natural person.
  • Data transfer: making personal data accessible to a specific third party.
  • Personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
  • NAIH: the Hungarian National Authority for Data Protection and Freedom of Information, the supervisory authority under the GDPR for Hungary.

3. Core principles of data processing

Personal data shall be:

  • processed lawfully, fairly and in a transparent manner (“lawfulness, fairness and transparency”);
  • collected only for specified, explicit and legitimate purposes (“purpose limitation”);
  • adequate, relevant and limited to what is necessary (“data minimisation”);
  • accurate and kept up to date, with inaccurate data erased or rectified without delay (“accuracy”);
  • kept in a form permitting identification for no longer than necessary (“storage limitation”);
  • processed with appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage (“integrity and confidentiality”).

4. Data we process

4.1 Contact and property inquiries (contact and inquiry forms)

Data subjects: natural persons who submit the Website's contact form (/kapcsolat) or a property-specific inquiry form.

Purpose: contacting you, responding to your inquiry, and providing our real estate brokerage services.

Data processed: name, email address, phone number, the message you provide, the nature of your inquiry (e.g. buying, renting, selling, letting), the source of your inquiry (e.g. Google, Facebook, Instagram, referral) and, for property-specific inquiries, the reference and name of the property.

Legal basis: your consent (Art. 6(1)(a) GDPR).

Retention: until you withdraw your consent, or for a reasonable period after your inquiry is closed.

Providing this data is voluntary, but without it we cannot contact you or respond to your inquiry. You may withdraw your consent at any time, free of charge; this does not affect the lawfulness of processing before the withdrawal.

4.2 Data processed automatically while using the website

While using the Website, technical data (e.g. your language preference, your browser-stored list of favourite properties) is recorded via strictly necessary cookies. The legal basis is our legitimate interest in providing the service, and no separate consent is required — see section 8.

5. Data security

We ensure the security of the personal data we process through technical and organisational measures and procedures. Data is protected against unauthorised access, alteration, transmission, disclosure, erasure or destruction, as well as accidental loss and damage. Only staff who need the data to perform their duties have access to it.

6. Data transfers, processors

We transfer or disclose the personal data of Website users only to the partners/processors specified in this section, and to authorities upon lawful request. We maintain an agreement covering the details of processing with each partner/processor involved in our data-processing activities.

Our processors:

  • Vercel Inc. — hosting provider and runtime environment for the Website (Next.js application).
  • Supabase (Supabase Inc. / Supabase Pte Ltd.) — database and image storage provider, used to store property data and images.
  • Cloudflare, Inc. — the server (Cloudflare Worker) that receives contact and inquiry form submissions and forwards them to our customer relationship (CRM) system.
  • GoHighLevel / LeadConnector (HighLevel Inc.) — customer relationship (CRM) system, where inquiries are recorded as contacts and opportunities.

7. Your rights

7.1 Right to prior information

You are entitled to receive transparent, intelligible and easily accessible information from the Controller before processing of your personal data begins.

7.2 Right of access

You are entitled to obtain confirmation from the Controller as to whether personal data concerning you is being processed, and, if so, to access that data and related information (purposes, categories of data, recipients, retention period, your rights).

7.3 Right to rectification

You are entitled to have inaccurate personal data concerning you rectified, and incomplete data completed, without undue delay.

7.4 Right to erasure (“right to be forgotten”)

You are entitled to have your personal data erased without undue delay where, among other grounds, it is no longer necessary, you withdraw your consent, or the data has been unlawfully processed.

7.5 Right to restriction of processing

You are entitled to obtain restriction of processing, for example where you contest the accuracy of the data or have objected to the processing.

7.6 Notification obligation regarding rectification, erasure or restriction

You may request that the Controller inform every recipient to whom your personal data was disclosed of any rectification, erasure or restriction.

7.7 Right to data portability

Where processing is based on consent or a contract and is carried out by automated means, you are entitled to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

7.8 Right to object

You are entitled to object, on grounds relating to your particular situation, to processing of your personal data based on the legitimate interests of the Controller or a third party.

7.9 Automated decision-making, profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

7.10 Right to be informed of a personal data breach

You have the right to be informed by the Controller of a personal data breach concerning you where the breach is likely to result in a high risk to your rights and freedoms.

7.11 Right to lodge a complaint with a supervisory authority

Every data subject has the right to lodge a complaint with a supervisory authority if they consider that the processing of their personal data infringes the GDPR.

Hungarian supervisory authority: National Authority for Data Protection and Freedom of Information (postal address: 1363 Budapest, Pf. 9., seat: 1055 Budapest, Falk Miksa utca 9-11., website: www.naih.hu, phone: +36-1-391-1400, email: ugyfelszolgalat@naih.hu).

7.12 Right to an effective judicial remedy against a supervisory authority

Every natural and legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

To exercise your rights: by post to our registered seat above, or by email to the address above. We cannot disclose personal-data-related information by phone, as we cannot verify the caller's identity.

8. Cookies

8.1 What are cookies?

Cookies are small text files placed on your device (computer, smartphone, tablet) by the Website through your browser. Some cookies are essential for the site to function, while others serve statistical or marketing purposes.

8.2 Consent to the use of cookies

Strictly necessary cookies are used automatically, as the Website cannot function properly without them. Analytics and marketing cookies are only placed with your prior, explicit consent — you can grant or withdraw this consent at any time, per category, via the cookie banner shown on the Website.

8.3 Cookies we use

Strictly necessary (functional) cookies: required for the Website's basic operation (e.g. remembering your language setting and cookie consent, your browser-stored list of favourite properties). Typically valid until the end of the session or for up to 1 year.

Analytics and marketing cookies: as of the date of this Policy, the Website does not use any analytics (e.g. Google Analytics) or marketing (e.g. Facebook Pixel) cookies. If such a service is introduced in the future, it will only be activated with your prior consent, and this Policy will be updated accordingly.

8.4 Managing and disabling cookies

Modern browsers allow you to change your cookie settings. You can configure your browser to prevent the automatic acceptance of cookies in the future.

8.5 Your rights regarding cookie processing

Under the GDPR, you also have the rights set out in section 7 of this Policy in connection with cookie processing.

8.6 Amendment of this Policy

The Controller reserves the right to amend this Policy at any time. Data subjects will be notified of any amendment upon their next visit to the Website. The amended Policy takes effect upon publication.