Privacy Notice
How budapest.app handles your personal data under the GDPR.
Version 2026-10-22.1 · Last updated 2026-10-22
Draft — pending legal review. This text is a working draft and not yet binding; placeholders in brackets will be completed before launch.
1. Data controller
[COMPANY NAME], registered office: [REGISTERED ADDRESS], company registration number: [COMPANY REGISTRATION NUMBER]. E-mail: [PRIVACY E-MAIL]. Data protection officer (if appointed): [DPO CONTACT].
2. What we process
Account data: display name, home country, language, the sign-in method you use (phone number, e-mail address, or an Apple/Google identifier), age confirmation and your acceptance of these documents.
Trip and community data: trip dates, interests, the programs, events, places and footprints you post or join, and messages in chats.
Reservation data: deal passes, their status and redemption, shared with the business and Zsákmány to fulfil the reservation.
Technical data: IP address, approximate country derived from it, device and session information, security logs.
3. Purposes and legal bases
Providing the service and your reservations — performance of a contract (Art. 6(1)(b) GDPR).
Security, fraud prevention, rate limiting and region-specific sign-in rules — legitimate interests (Art. 6(1)(f)).
Moderation and handling notices under the Digital Services Act — legal obligation (Art. 6(1)(c)) and legitimate interests.
Optional features such as showing you on the Travelers list — your choice, which you can change at any time.
4. Location privacy
We never show your exact location to other people. Distances are rounded to 100 m, footprint positions are shifted by 150–300 m, and a program's meeting point is visible only to approved participants. A recent position you share is kept for at most 2 hours.
5. Recipients and processors
Zsákmány ([ZSÁKMÁNY OPERATOR NAME]) and the business you reserve with; hosting and database providers; SMS and e-mail delivery providers; IP geolocation; image moderation; map providers when you open a map. A current list: [PROCESSOR LIST LINK].
Some providers are outside the EEA. Transfers rely on adequacy decisions or standard contractual clauses.
6. How long we keep data
Account data: until you delete your account, then 30 days before erasure. Footprints: 7 days. Sign-in codes: minutes. Reservation records and logs: as long as accounting and legal obligations require ([RETENTION PERIODS]).
7. Your rights
You have the right to access, rectify, erase and port your data, to restrict or object to processing, and to withdraw consent. Write to [PRIVACY E-MAIL]; we answer within one month.
You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9–11, naih.hu) or with the authority of your country of residence.
8. Age limit
Accounts are for people aged 18 or older. If we learn that an account belongs to someone younger, we delete it.
9. Changes
We publish changes here with a new version number and tell account holders about material changes in advance.
Questions: [CONTACT E-MAIL]