Privacy Notice

The controller is Egri Ingatlan Korlátolt Felelősségű Társaság, operating the short-term rental management service under the brand DavidBnB.AI.

For any questions or requests relating to data processing please contact us at [email protected]. To enable a substantive response, please make sure to identify the relevant data (e.g. the e-mail address used, property, booking).

Under Article 37 GDPR the appointment of a Data Protection Officer (DPO) is not mandatory for the controller, as neither the nature of our activities nor the volume or category of the data processed triggers this obligation. Privacy matters are the responsibility of the managing director.

Terms used in this notice carry the meaning given by the GDPR and the Hungarian Information Act (Act CXII of 2011); the short summary below is provided for readability only.

Personal data

Any information relating to an identified or identifiable natural person (e.g. name, e-mail address, IP address, booking ID).

Data subject

The natural person whose personal data is processed (e.g. website visitor, lead, owner, guest).

Controller

The organisation that determines the purposes and means of personal data processing – here, Egri Ingatlan Kft.

Processor

An entity that processes personal data on behalf of and on instruction of the controller (e.g. hosting provider, e-mail delivery service, AI provider).

Processing

Any operation performed on personal data: collection, recording, storage, alteration, transfer, deletion, etc.

Consent

A freely given, specific, informed and unambiguous indication of the data subject's wishes signifying agreement to the processing of personal data.

Recipient

Any natural or legal person to whom personal data is disclosed or who is granted access (e.g. authority, partner, service provider).

Profiling

Automated evaluation of personal data to assess certain personal aspects (e.g. interests, willingness to purchase). DavidBnB does not apply solely automated decision-making with legal effects on data subjects – see section 13.

Personal data breach

A security event leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data processed.

Third country

A country outside the European Economic Area (e.g. USA, UK, UAE).

Our data processing practice is based on the following legal sources:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
• Act CXII of 2011 on the right to informational self-determination and freedom of information (Information Act, "Infotv.").
• Act CVIII of 2001 on certain aspects of electronic commerce services ("Eker. tv.").
• Act XLVIII of 2008 on the basic conditions and certain limitations of business advertising activity ("Grt.").
• Act C of 2000 on Accounting ("Számv. tv.") – 8-year retention of accounting documents.
• Act CL of 2017 on the Order of Taxation ("Art.").
• Act C of 1990 on Local Taxes – tourism tax (IFA).
• Government Decree 239/2009 (X. 20.) on the conditions of providing other accommodation services.
• Government Decree 235/2019 (X. 15.) on the operation of the National Tourism Data Provision Centre (NTAK) and the related data reporting obligations.
• Act II of 2007 on the entry and stay of third-country nationals – the legal basis for the mandatory data reporting to the Closed Guest Information Database (VIZA) / Tourism Information System (TIM).

We process personal data in line with the principles laid down in Article 5 GDPR.

• Lawfulness, fairness and transparency – every processing purpose has a clear legal basis and is communicated.
• Purpose limitation – we only process data needed to achieve the specified, lawful purpose.
• Data minimisation – we do not request or store more data than what is strictly necessary.
• Accuracy – we strive to keep data accurate and up to date; we rectify inaccurate data without delay.
• Storage limitation – every purpose is paired with a concrete retention period; once it expires we delete or anonymise the data.
• Integrity and confidentiality – we protect data against unauthorised access and damage with technical and organisational measures.
• Accountability – we document and demonstrate compliance with the principles above.

The table below summarises for what purpose, on what legal basis, for what category of data subjects, what data we process and for how long. Section 7 separately highlights when DavidBnB acts as a processor (guest data).

When a property owner uses the DavidBnB platform to operate their property and communicate with guests, the controller of the guests' personal data is the owner – DavidBnB acts as a processor under Article 28 GDPR. The following terms apply in this relationship:

• A Data Processing Agreement (DPA) is concluded between the owner and DavidBnB defining the purpose, scope and duration of the processing.
• DavidBnB processes the data only on documented instructions of the owner, save where required to do so by law.
• Confidentiality obligations are imposed on every member of staff and sub-processor who has access to the data.
• Sub-processors may be engaged based on the owner's general or specific authorisation; the providers listed in section 8 partially serve as sub-processors.
• We support the owner with appropriate technical and organisational measures in fulfilling data subject rights.
• We notify the owner of any personal data breach without undue delay.
• Upon termination of the service we either return or delete the data, at the owner's choice, except where retention is required by law.

Where the law obliges us to process guest data in our own right (NTAK, VIZA, accounting), we act as a controller – this is reflected in the relevant rows of section 6.

We rely on the following processors (technical and business partners) to operate our service. We have a Data Processing Agreement (DPA) in place with each of them and require them to provide guarantees compliant with Article 28 GDPR.

Some of our processors (in particular technology providers based in the United States) are located outside the European Economic Area. Such transfers are protected by the appropriate safeguards under Chapter V of the GDPR.

• EU–US Data Privacy Framework (DPF) – the adequacy decision (2023/1795/EU) for certified US providers. DavidBnB uses the following DPF-certified providers: OpenAI, Mailgun, Twilio, Stripe (Stripe, Inc.), Hospitable, Vultr (we regularly verify the certification at https://www.dataprivacyframework.gov).
• European Commission Standard Contractual Clauses (SCCs) [2021/914/EU], concluded with every provider where DPF certification is not in place or has lapsed.
• Supplementary measures: encryption in transit (TLS 1.2+) and at rest (AES-256), access controls, internal legal review, Transfer Impact Assessment.
• Stripe Payments Europe Limited (an EU company) is the primary contracting partner; transfers to Stripe, Inc. are governed by the Stripe group's combination of SCCs and DPF certification.

For details of the safeguards in place for international transfers, including copies of the relevant documents, please contact us at [email protected].

Our website uses cookies and browser-side storage (localStorage) to function correctly and – only with your consent – for marketing.

We safeguard the confidentiality, integrity and availability of personal data through the following technical and organisational measures:

• Encrypted communication (TLS 1.2+) on all public endpoints.
• Encrypted storage (AES-256) for databases and backups.
• Secure password storage (bcrypt one-way hash with salting).
• Role-based access control (RBAC), principle of least privilege, multi-factor authentication on internal tools.
• Logging and audit (central audit-trail through NATS events) – detection of unauthorised access.
• Firewalls, network segmentation (private NATS, private database network), DDoS filtering.
• Software updates, vulnerability monitoring and patch management.
• Daily backups with georedundant storage.
• Confidentiality undertakings and privacy training for staff.
• Internal procedure for handling personal data breaches.

Under Articles 12–22 GDPR data subjects may exercise the following rights:

Right to information

You receive information on our processing in a concise, transparent and easily understandable form – this notice serves that purpose.

Right of access

You may obtain confirmation as to whether we process personal data concerning you; if so, we provide access and a copy of the data.

Right to rectification

You may request the correction of inaccurate data or completion of incomplete data.

Right to erasure ("right to be forgotten")

In the cases set out in Article 17 GDPR you may request deletion of your data – unless processing is still required by law or compelling legitimate interests (e.g. accounting).

Right to restriction

In certain situations (e.g. while a rectification is being verified) you may request the processing to be restricted – only storage continues during this period.

Right to data portability

You may receive the data you have provided to us in a structured, machine-readable format (e.g. JSON) or have it transmitted to another controller, where technically feasible.

Right to object

You may object to processing based on legitimate interest, in particular for direct marketing purposes.

Withdrawal of consent

You may withdraw any previously given consent at any time, free of charge – this does not affect the lawfulness of processing prior to the withdrawal.

Exemption from automated decision-making

We do not use solely automated decision-making with legal effects; should such a situation arise you may request human intervention.

Requests to exercise your rights can be sent to [email protected] or by post (Egri Ingatlan Kft., 4033 Debrecen, Fülöp utca 4., Hungary). We respond within the deadline set by Article 12(3) GDPR – ordinarily within one month, with a possible two-month extension where justified. Exercising your rights is free of charge; for manifestly unfounded or excessive requests we may charge a reasonable fee or refuse to act.

Artificial intelligence is at the core of our service: we generate guest answers, suggestions, schedules and summaries with LLM models. The following principles apply:

• AI processing is intended to make guest communication and operations faster and more accurate – not to replace decision-making.
• Decisions producing legal effects on guests (e.g. booking refusal, security deposit hold) are always reviewed by a human (autopilot review queue).
• We minimise the data sent to AI models and avoid forwarding special categories of data.
• DavidBnB uses OpenAI under the API platform terms, which by default exclude API content from being used to train OpenAI's models.
• The DPA with the owner specifies the conditions under which AI processing on guest data may take place.
• Profiling for marketing remarketing is performed only based on consent given to the Meta Pixel and TikTok Pixel – this consent can be withdrawn at any time.

Under Article 33 GDPR we notify the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) within 72 hours of becoming aware of a personal data breach where it is likely to result in a risk to the rights and freedoms of data subjects. Where the risk is high we also notify the affected individuals directly under Article 34 GDPR.

• We document incidents in an internal incident log (event, affected subjects, impact, measures taken).
• Our processors are contractually obliged to notify us of any breach they detect without undue delay.
• We notify owners (as controllers) of any incident affecting their guest data.

If you believe that our processing infringes the GDPR or other applicable law, the following remedies are available to you:

Data subjects may also turn to the civil courts: a claim can be filed before the Budapest Metropolitan Court or the regional court of their place of residence. Before initiating a claim we kindly ask you to contact us first at [email protected] so we can try to resolve the matter together.

The Controller reserves the right to amend this notice unilaterally – e.g. due to legislative changes, the introduction of a new service or security improvements. Material changes are communicated in advance with appropriate timing (e.g. via a notice on the website or, for logged-in users, by e-mail).

The version number and the date of the latest update are shown at the top of the document. A copy of earlier versions can be requested at [email protected].