Privacy policy

BookBudapest Kft. is committed to protecting the personal data of guests, website visitors, property owners and other enquirers. This Privacy Policy explains what personal data BookBudapest Kft. processes, for what purposes and on what legal bases, how long the data is retained, who may receive it, and what rights data subjects have.

We process personal data in accordance with applicable data-protection law, including Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and relevant Hungarian legislation.

1. Data Controller

BookBudapest Kft. Registered office: 1074 Budapest, Dob utca 31. 2/14., Hungary Company registration number: 01-09-423530 Tax number: 32426991-2-42 EU VAT number: HU32426991 Email: office@bookbudapest.hu Phone: +36 70 283 5888

For privacy-related questions or to exercise data-subject rights, please contact us at office@bookbudapest.hu.

2. General Data-Protection Principles

We process only personal data that is necessary for the relevant service, booking, legal obligation, communication or – where appropriate – analytics and marketing purposes.

We aim to process personal data only to the extent necessary for the relevant purpose, to protect it with appropriate technical and organisational measures, and not to sell personal data to third parties.

3. Website Use and Technical Log Data

When bookbudapest.hu is used, technical information may be generated that is necessary for the operation and security of the website, including for example:

• IP address;
• date and time of access;
• browser and device technical information;
• requested page or URL;
• server logs relating to errors and security events.

Purpose: operation and security of the website, error detection, prevention of unauthorised access and troubleshooting.

Legal basis: BookBudapest’s legitimate interest in maintaining a secure and properly functioning website.

Retention: only for as long as reasonably necessary for technical, security and troubleshooting purposes.

Production hosting provider:

Websupport Magyarország Kft. 1119 Budapest, Fehérvári út 97–99., Hungary Company registration number: 01-09-381419 Tax number: 25138205-2-43

4. Direct Bookings and Reservation Management

BookBudapest’s direct booking process is connected to the SabeeApp system.

Depending on the booking flow, the personal data processed may include:

• name;
• email address;
• telephone number;
• country and other contact details required for the booking;
• arrival and departure dates;
• number of guests;
• selected apartment;
• booking identifier;
• booking price and payment status;
• messages or special requests related to the reservation.

Purpose: creation, confirmation and fulfilment of the reservation; guest communication; payment handling; arrival preparation; customer support; and handling possible claims or disputes.

Legal basis: steps taken at the request of the data subject before entering into a contract and performance of the accommodation contract; where applicable, compliance with legal obligations.

Retention: after the stay, for as long as necessary in connection with contractual, accounting, taxation and legal-claim requirements. Records subject to mandatory statutory retention periods are retained for the legally required period.

SabeeApp is a cloud-based hospitality management platform operated by thePass Kft. The exact controller/processor roles applicable to the active BookBudapest setup must follow the current SabeeApp contractual and data-processing documentation.

5. Online Payments – Stripe

Online card payments for direct bookings are processed with the involvement of Stripe.

Depending on the payment flow, data may include:

• amount and currency;
• transaction identifier;
• payment status;
• technical information required for the selected payment method;
• relevant contact and billing information.

BookBudapest does not ask guests to provide full payment-card details by email, telephone or WhatsApp, and does not store full card details in its own website database.

Purpose: processing online payments, confirming payment of reservations, refunds, payment disputes and fraud prevention.

Legal basis: performance of the accommodation contract and, for Stripe’s own mandatory financial, security or compliance processing, the legal bases determined by Stripe.

Relevant Stripe entities for EEA services may include:

Stripe Payments Europe, Limited 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland

and, where applicable to regulated financial services:

Stripe Technology Europe, Limited 1 Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland.

Depending on the processing activity, Stripe may act as a processor or as an independent controller.

6. GuestAdvisor and Mandatory Guest Registration

BookBudapest uses SabeeApp GuestAdvisor to support parts of the guest journey and digital guest registration.

GuestAdvisor may process booking-related data such as name, email address, telephone number, arrival and departure information and other data required in the active guest-registration flow.

Hungarian accommodation providers are required by law to record and transmit specified guest information through the VIZA (Closed Guest Information Database) system.

Depending on the applicable legal requirements, the recorded information may include:

• family name and given name;
• birth family name and given name;
• place and date of birth;
• sex;
• nationality;
• mother’s birth family name and given name;
• for guests aged 14 or older, identification document or travel-document identification data;
• accommodation address;
• start date and expected and actual end date of the stay.

For guests under the age of 14, required information may in applicable cases be recorded on the basis of a declaration by the parent or other legal representative.

The image of an identification document must not be retained merely as part of the VIZA registration process where the applicable legal rules prohibit such retention.

Purpose: compliance with mandatory guest-registration obligations.

Legal basis: compliance with a legal obligation.

The accommodation provider remains responsible for the guest-registration process. Any roles of SabeeApp, GuestAdvisor, the Hungarian Tourism Agency or other service providers must follow the applicable statutory and contractual framework.

7. General Contact Form

When a visitor contacts BookBudapest through the website, we may process:

• name;
• email address;
• telephone number, if provided;
• message;
• date and time of submission;
• technical data necessary to secure the form.

Purpose: responding to the enquiry and managing the communication.

Legal basis: where the enquiry relates to entering into a contract, steps taken at the request of the data subject before entering into a contract; for other general enquiries, BookBudapest’s legitimate interest in responding to incoming communications.

Retention: until the enquiry is closed and thereafter only for as long as reasonably necessary for any related legal claims or legitimate record-keeping need. Enquiries that do not lead to a business relationship should not be retained indefinitely.

Submissions may be stored in the website administration system. BookBudapest may also receive an email notification at office@bookbudapest.hu.

8. Property-Owner Enquiries / For Owners

If a property owner or prospective partner contacts BookBudapest regarding short-term rental management, the website may process, depending on the form fields:

• name;
• email address;
• telephone number;
• property address or location;
• property size;
• number of bedrooms;
• guest capacity;
• information about balcony, parking and other property characteristics;
• free-text message.

Purpose: assessing a potential property-management cooperation, contacting the owner and preparing a proposal.

Legal basis: steps taken at the request of the data subject before entering into a contract.

Retention: until the enquiry and related discussions are closed, and thereafter only for as long as reasonably necessary in connection with possible legal claims. If a contract is concluded, further processing will follow the rules applicable to the contractual relationship and relevant legal obligations.

9. Email Marketing and Newsletter

BookBudapest may in the future offer newsletters, special offers or other marketing communications by email.

Marketing emails will only be sent where an appropriate legal basis exists, in particular prior consent where required.

Consent must be voluntary, separate from the accommodation booking itself, capable of being withdrawn at any time, and accompanied by an easy unsubscribe method in each marketing email.

Data that may be processed: email address, name if collected, time of subscription, information necessary to demonstrate consent, and unsubscribe status.

Retention: until consent is withdrawn, with limited evidence of consent retained where necessary to demonstrate compliance.

The final newsletter/email-marketing provider has not yet been selected. This Privacy Policy must be updated with the actual provider before the newsletter function is launched.

10. Analytics, Conversion Measurement and Online Advertising

BookBudapest may use analytics and advertising technologies to measure website performance and improve marketing. The planned implementation may include:

• Google Tag Manager;
• Google Analytics 4;
• Google Ads conversion measurement;
• Meta Pixel;
• Microsoft Clarity.

Non-essential analytics and advertising technologies must only be activated after the visitor has provided the required consent.

Depending on the service, processed data may include cookie and other online identifiers, technical information linked to an IP address, browser and device information, pages visited, clicks and website interactions, campaign/referral information, and technically measurable steps in the booking funnel.

BookBudapest does not intend to transmit sensitive personal data or full payment-card information to advertising platforms.

Legal basis: where consent is required, the visitor’s prior consent.

Visitors must be able to reject non-essential analytics and marketing technologies through the cookie banner and later change their choices through Cookie settings / Süti beállítások.

The separate Cookie Policy must list only those cookies, tags and providers that are actually implemented at launch.

11. Strictly Necessary Cookies

The website may use technical cookies or similar technologies required for essential functions such as website security, session or technical operation, language preferences and storing the visitor’s cookie-consent choices.

Strictly necessary technologies are not used for advertising purposes.

Analytics and marketing technologies must be treated separately and remain inactive until the required consent has been obtained.

12. Processors and Other Recipients

Depending on the relevant processing activity, personal data may be accessible to service providers only to the extent necessary for their services. These categories currently include or may include:

• hosting and IT infrastructure: Websupport Magyarország Kft.;
• property management system, booking engine and GuestAdvisor: SabeeApp / thePass Kft.;
• online payments: the relevant Stripe group entities;
• VIZA-related infrastructure: relevant public authorities and processors in the legally defined roles;
• invoicing and accounting service providers;
• legal and other professional advisers where necessary for a particular matter;
• analytics and advertising providers only if the respective technology is actually deployed and the required consent exists.

The precise provider list must reflect the actual production configuration.

13. International Data Transfers

Some international technology providers, particularly payment, analytics or advertising services, may process or access personal data outside the European Economic Area.

Where such transfers occur, they must rely on an appropriate legal transfer mechanism, such as an adequacy decision of the European Commission, EU Standard Contractual Clauses, where applicable the EU–US Data Privacy Framework, or another lawful transfer mechanism permitted by the GDPR.

14. Data Security

BookBudapest applies or aims to apply appropriate technical and organisational measures to protect personal data. These may include:

• HTTPS-encrypted connections;
• restricted access permissions;
• protected administrator accounts;
• secure password practices;
• regular software and security updates;
• backups;
• logging and error monitoring;
• separation of payment-card handling through Stripe rather than storing full card details in BookBudapest’s own database.

Access to personal data should be limited to persons who need it for their role.

15. Data-Subject Rights

Subject to the conditions of the GDPR, a data subject may request:

• information about the processing of their personal data;
• access to their personal data;
• rectification of inaccurate data;
• erasure of data where the legal conditions are met;
• restriction of processing;
• data portability where applicable;
• the right to object to processing based on legitimate interests;
• withdrawal of consent at any time where processing is based on consent.

Requests may be submitted to office@bookbudapest.hu.

BookBudapest will respond without undue delay and generally within the time limits established by the GDPR. The standard response period is one month, subject to the extensions permitted by law for complex or numerous requests.

Certain rights are not absolute. For example, data cannot be erased where continued retention is required by law.

16. Complaints and Legal Remedies

If you believe that your personal data has been processed unlawfully, please first contact:

BookBudapest Kft. office@bookbudapest.hu

You also have the right to lodge a complaint with:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH) 1055 Budapest, Falk Miksa utca 9–11., Hungary Postal address: 1363 Budapest, Pf. 9. Telephone: +36 1 391 1400

You may also seek a judicial remedy in accordance with the GDPR and applicable Hungarian law.

17. Automated Decision-Making and Profiling

BookBudapest does not currently use solely automated decision-making that produces legal effects concerning a person or similarly significantly affects that person.

If advertising technologies are later used for audience creation, remarketing or similar profiling activities, those technologies may only operate in accordance with applicable consent requirements and the Cookie Policy must be updated accordingly.

18. Data Relating to Minors

The BookBudapest website and booking process are not specifically directed at children.

However, personal data relating to minor guests may need to be processed in connection with the accommodation contract and mandatory Hungarian guest-registration requirements.

For guests under the age of 14, required VIZA information may, where permitted by applicable law, be recorded on the basis of a declaration by a parent or legal representative.

19. External Websites and Services

The BookBudapest website may contain links to or integrations with third-party services that operate under their own privacy rules, including for example:

• SabeeApp / GuestAdvisor;
• Stripe;
• map services;
• analytics or advertising platforms activated in the future.

Where a function opens in an external service environment, the user should be informed where appropriate.

20. Changes to This Privacy Policy

BookBudapest may update this Privacy Policy where necessary, including because of:

• introduction of a new service;
• changes to processors or technology providers;
• implementation of analytics or advertising systems;
• changes in law;
• material changes to BookBudapest’s data-processing practices.

The current version must always be available on bookbudapest.hu, with the effective date or last-updated date clearly displayed.

BookBudapest Kft. · 32426991-2-42 · HU32426991 · 01-09-423530 · 1074 Budapest, Dob utca 31. 2/14.