Privacy notice

Who handles it

The controller is the operator of this site named below, reachable at the email address given.

What we handle and why

The name, email address, telephone number and message you type into the contact form. The purpose is answering your enquiry; the legal basis is your consent, given by sending the form. The sender's IP address appears on one line of the notification email we receive, so that abuse can be recognised; it is not written to the site's own store — it stays in our mailbox with that email and goes when the email goes. Separately, the server's access log and the services' operational logs record the IP address a request came from, the time of the request, the address requested and the browser identifier — for secure operation, on the basis of our legitimate interests (Article 6(1)(f) GDPR). These logs are rotated by size: a closed log file is kept for at most seven days.

How long we keep it

Enquiries stay in our mailbox and in the site's own store until the matter is closed, and at most two years. Deletion is not automatic: we delete the enquiry ourselves in the admin interface. The store moves older enquiries into a yearly archive file, which the admin list no longer shows; what remains there we have deleted on request by the provider who runs the system. If an enquiry becomes a contract, accounting retention periods apply instead.

Who else sees it

What you send us we do not sell, and we do not pass it on for advertising. It reaches exactly as far as running the site requires: the email provider and the hosting provider — and, where switched on for this site, the services described separately below. One of them is Google's tag: if the visitor has accepted it on the cookie bar, their browser also tells Google that they were here, and Google uses that for the purposes set out in the “Google Ads and cookies” section — with an advertising tag, to measure how the ads performed and to show ads later to people who have visited the site (remarketing). What a visitor types into the form — their name, email address, telephone number and message — the site does not send to Google.

Email delivery

The site's emails — such as the notice of an enquiry to the office and the confirmation sent to the visitor — are delivered by Scaleway SAS (Paris, France), within the European Economic Area and solely for delivery.

The AI recommender

A question put to the site's recommender — together with the conversation so far — goes to an external AI provider, which produces the answer: OpenAI (OpenAI Ireland Ltd., Dublin, Ireland). Only the public details of the listings travel with it. The recommender asks for no name and no email address, and the site does not store what a visitor asks: the browser sends the history along with each question, and the server discards it once the answer is out. If a visitor speaks a question instead of typing it, their own browser turns the speech into text — using the browser vendor's service — and the site receives only the text. The provider uses the submitted text to produce the answer, does not use it to train its models, and keeps it for at most thirty days to detect abuse. Where it also processes the data outside the European Economic Area, this rests on the European Commission's standard contractual clauses, which form part of the provider's data processing agreement, or on the EU–US Data Privacy Framework.

Live customer chat

If a visitor asks for a person in the conversation, what has been said so far and every later message is kept in the site's own store, so that a colleague can carry on and the office can read it back later — along with the page and the listing where the conversation started. The chat asks for no name and no contact details; a visitor who wants a reply by email gives it on the contact form, and it is handled as an enquiry under the rules above. The legal basis is the visitor's request that started the conversation. A conversation is not deleted automatically: it stays in the store until the office deletes it in the admin — and a visitor can ask for that at any time.

The footage behind the page

The footage behind this site is served by a content delivery network (veduta.b-cdn.net — BunnyWay d.o.o., Slovenia): the visitor's browser fetches it from there, so that server sees the visitor's IP address — solely to deliver the file; it sets no cookie and does not track. For a browser that asks for data saving or reduced motion, the footage is not downloaded at all.

Google Ads and cookies

This site also runs Google's advertising tag (Google Ads) — but only if the visitor has accepted it on the cookie bar shown at the bottom of the page. The tag measures how many visitors arrived from the agency's Google ads, and it lets Google show ads later to people who have visited the site (remarketing). For this, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) places cookies in the visitor's browser and, as an independent controller, processes the visitor's IP address, the characteristics of the browser and the addresses of the pages viewed: on this site's own domain _gcl_au (90 days), for a visitor arriving from an ad click also _gcl_aw, _gcl_gs, _gcl_gb and _gcl_ag (90 days), in some cases _gads (13 months), and on the doubleclick.net domain IDE (13 months) and test_cookie (15 minutes); in the browser's own storage Google places the entry _gcl_ls (about 90 days). If the visitor withdraws consent, the tag is not loaded again, the site expires the cookies whose names start with _gcl_ and removes the _gcl_ls entry from the browser's storage; IDE and test_cookie sit on Google's own doubleclick.net domain, which the site cannot reach — they can be removed in the browser's settings or through Google's ad settings. The legal basis is the visitor's consent (Article 6(1)(a) GDPR, together with Article 5(3) of the ePrivacy Directive and its national implementation); consent can be withdrawn at any time with the “Cookie settings” button in the footer, and from then on the tag is not loaded at all. The site remembers the visitor's decision in its own cookie named veduta-consent for 182 days — a necessary cookie that needs no consent and identifies nobody. The collection in the visitor's browser, and the fact that this data reaches Google, are the responsibility of the operator of this site — with an advertising tag, jointly with Google as joint controllers; what happens to the data afterwards Google decides on its own and describes in its own notice. A visitor may exercise their rights against either of us. Google may also process the data outside the European Union, in the United States, on the basis of the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.

Google's privacy policyHow Google uses data from sites that use its servicesGoogle's list of advertising cookiesAd settings at Google (opt out)

Cookies

The only analytics or advertising cookies on this site come through the Google tag, and only with the visitor's consent — see the “Google Ads and cookies” section. Apart from that, cookies are used only for administrator sign-in: the session cookie, and a short-lived cookie for the middle step of two-step sign-in — a visitor never receives either — and the veduta-consent cookie, which remembers the visitor's cookie decision. In the browser's own storage we keep only what the visitor has chosen about the display — such as light or dark mode and the quality of the 3D view — and, until the tab is closed, the fact that a pop-up message has already been seen; none of that identifies anyone, and none of it reaches us. After consent, Google's entry named _gcl_ls is kept there too (about 90 days), which records an ad click for Google.

Your rights

You may ask for a copy of what we hold about you, for it to be corrected or deleted, for the processing to be restricted, and for your data in a portable form. You may object to processing based on legitimate interests — the logs, for example — and you may withdraw consent at any time; withdrawal does not affect the lawfulness of the processing carried out before it. We answer within one month at the latest. Complaints go to the Hungarian data protection authority (NAIH, 1055 Budapest, Falk Miksa utca 9-11., naih.hu), and you may also go to court: proceedings may be brought before the regional court for the place where you live or stay.