Privacy Policy Doma Budapest

Last updated: September 24, 2026

1. Data Controller

Doma Budapestis operated by Tímea Szabó, a private individual residing in Hungary. For privacy and security reasons, the exact apartment address is not displayed publicly; it is shared only with guests after a booking has been confirmed.

2. Data We Collect

When you contact our website or use the booking interface, we collect the following personal data:

  • Information provided in the booking request form: Your name, email address, phone number, requested arrival and departure dates, number of guests, and any comments/messages you may include.
  • Technical data: IP address, browser type, and other data from server logs to ensure secure operation.

3. Legal Basis for Processing

We process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

  • Contractual necessity (GDPR Art. 6(1)(b)) Processing booking requests and coordinating availability is essential for preparing and concluding a subsequent rental agreement between the parties.
  • Consent (GDPR Art. 6(1)(a)): When you voluntarily fill out and submit the booking/contact form.
  • Legitimate interest (GDPR Art. 6(1)(f)): Administering incoming inquiries, managing correspondence, and ensuring the security and functionality of our website.
  • Compliance with a legal obligation (GDPR Art. 6(1)(c)): Personal data may be processed where necessary to comply with Hungarian legal, accounting, tax and guest administration obligations.

4. Purpose of Processing and Process Overview

We use your personal data exclusively for the following purposes:

  • Receiving booking requests: After the form is submitted, our system sends anautomatic emailto the email address you provided, confirming receipt of your request. This message does not constitute final acceptance of the booking.
  • Manual confirmation and coordination: Based on this data, we check the availability of the apartment, andmanually confirmthe booking to you, or contact you to coordinate the details.
  • Security: Maintaining the secure, abuse-free operation of the website.
  • Required administration: Data related to confirmed bookings is used only for guest reception, communication, and compliance with legal and administrative obligations.

5. Third-Party Services (Data Processors)

To operate our website, we use the following service providers, who handle the technical processing of data:

  • Rackhost Zrt.: Our hosting provider, operating in Hungary, which provides the server infrastructure as well as the automatic email dispatch system. All data is stored within the European Union.
  • Google Maps: Used to display the approximate area of the apartment. The exact address is not displayed publicly. When the map loads, Google may process your IP address and place cookies in accordance with its own privacy policy.
  • Operating partner: If an on-site operating partner assists with guest reception, basic contact details of confirmed guests (name, arrival time, phone number) may be shared with them to ensure smooth check-in and local administration.

6. Data Transfers

Personal data collected on the website is primarily stored on servers within the European Union. Once a booking is finalized, we may transfer the guest's name and contact details to our on-site operating partner in order to ensure arrival at the accommodation. We do not transfer personal data to third countries outside the European Economic Area (EEA).

7. Data Retention

Data provided in booking requests is retained only for as long as necessary to process the booking, receive guests, and maintain contact. If a booking request does not result in a confirmed booking (no manual confirmation occurs, or the guest withdraws), the data is deleted within 30 days. For successful bookings, correspondence may be retained for administrative and accounting purposes for up to two years, after which it is securely deleted.

8. Your Rights

Under the GDPR, you have the right to:

  • Access the data we hold about you and request information about how it is processed.
  • Request correction of inaccurate data or completion of incomplete data.
  • Request the deletion of your personal data (the right to be forgotten), where it is no longer needed for the performance of a contract or a legal obligation.
  • Request restriction of processing or object to the processing.
  • Withdraw your consent at any time.

To exercise these rights, please contact us at info@domabudapest.hu . We will respond to your request within 30 days at the latest.

9. Filing a Complaint

If you believe your personal data has been processed unlawfully, you have the right to file a complaint with a supervisory authority:

10. Security

We apply appropriate technical measures to protect your data. Our website is accessible via secureHTTPSprotocol (with SSL encryption), so data submitted via forms is transmitted through an encrypted channel.

11. Cookies

Our website may use essential and statistical cookies necessary for its operation. Detailed information on this is available in our separate Cookie Policy .

12. Future Online Payments

Currently, no direct online payments are processed on the website. Should such a feature be introduced in the future, payment data will be handled by a specialized, licensed third-party payment provider, and card data will not be stored on our servers. Payment method (bank transfer): Payment for the accommodation booking is made via bank transfer. During the transfer, the data you provide (account holder's name, bank account number, transaction amount, and reference) will appear on the Data Controller's bank statement. This data is used exclusively to identify the payment and to fulfill mandatory legal invoicing obligations.

13. Temporary identity-document images

Identity-document images provided through a private check-in link are processed solely to prepare the legally required guest registration in VENDÉGEM. Images are encrypted and stored outside the public website; access is limited to the authorised host, while the hosting provider acts only as an infrastructure processor. Images are deleted immediately after entry into VENDÉGEM and, in all cases, automatically no later than 48 hours after the first upload. They are not attached to emails, stored in the booking database, or used for profiling. Guests may contact the Data Controller using the details above about this processing.

We use essential cookies to run this website. With your permission, we can also load third-party services such as Google Maps, which may set their own cookies.

Cookie policy