Privacy Notice

1.The data controller and its contact details

The controller of your personal data is the developer of the YARA Residence project (the "Controller"):

• Company name: Faedra V. Ingatlanfejlesztő Részalap
• Registered office: 1132 Budapest, Váci út 22-24., 5. emelet
• MNB register number (Magyar Nemzeti Bank register): 1222-86-2
• Tax number: 19435747-2-41
• E-mail: faedrahomes@oc.hu

• Company name: Faedra Alapkezelő Zártkörűen Működő Részvénytársaság
• Registered office: 1132 Budapest, Váci út 22-24., 5. emelet
• Company registration number: 01-10-141781
• Tax number: 27780798-2-41
• Represented by: Nikolett Majorosi, CEO

The Controller is not obliged to appoint a data protection officer (DPO) under Article 37 GDPR and has not appointed one. Requests concerning data protection may be addressed to the contact details above; the Controller will respond without undue delay and in any event within one month of receipt.

2.Scope of this notice, applicable law

This notice covers the processing operations connected with the operation of the Website and the inquiry form available on it. The processing is governed by the GDPR and the Hungarian Privacy Act; with respect to cookies, it is also governed by Act CVIII of 2001 on Electronic Commerce and Act C of 2003 on Electronic Communications.

The source of the personal data is in every case the Data Subject: the Controller only processes data you provide through the Website and data generated technically in the course of its use. The Controller does not request or process special categories of data, and the Website is not directed at persons under the age of 16.

3.Handling inquiries: the inquiry form

Through the inquiry form on the Website you may request an offer or information about the apartments of the development. In doing so we process the following data:

• full name, phone number, e-mail address (mandatory fields);
• the residential project(s) you are interested in;
• the apartment size (number of rooms) you are looking for;
• your message (up to 500 characters, optional);
• your answer to "where did you hear about us", including the free-text detail given for the "other" option;
• whether you opted in to the newsletter;
• the fact of your acceptance of this privacy notice and the time of submission;
• the marketing source data of your visit: the landing page, referring page and campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) of your first and your most recent visit, and — where recognisable — the name of the property portal you arrived from (ingatlan.com, alberlet.hu, otthonterkep.hu, koltozz.hu); and, only where you have consented to statistics, the session identifier.

The purpose of the processing is receiving and answering your inquiry, providing an offer, arranging appointments and pre-contract communication. Its legal basis is Article 6(1)(b) GDPR: the processing is necessary in order to take steps at the request of the Data Subject prior to entering into a contract. Submitting the form is a request for an offer made at your own initiative, which cannot be answered without the data provided.

The "where did you hear about us" field is processed on the basis of the Controller's legitimate interest (Article 6(1)(f) GDPR) in measuring the effectiveness of its marketing activity and planning its sales channels. Under the balancing test, this data is neutral to the Data Subject, is limited to a single answer freely chosen by you, is evaluated in aggregate form only, involves no profiling, and you may object to this processing at any time (see Section 10).

The marketing source data are not asked for on the form: the Website stores them during your visit in a first-party entry in your browser's local storage (yara-attribution-v1), reads them only at the moment the form is submitted, and then transmits them together with your inquiry. The purpose is to allow an incoming inquiry to be attributed to the correct marketing channel — in particular to the property portal or campaign it came from; the legal basis is the Controller's legitimate interest under Article 6(1)(f) GDPR in measuring the effectiveness of its marketing activity and planning its sales channels. Under the balancing test, these data are limited to the circumstances of your arrival at the Website, the Controller does not learn your browsing history outside the Website, builds no profile of you on this basis and takes no automated decision, and you may object to this processing at any time (see Section 10). You may delete the entry at any time in your browser settings; the entries stored by the Website are described in detail in the Cookie Notice.

If you have consented to statistical processing in the cookie banner, the session identifier created in your browser's session storage (yara-session-v1) is transmitted together with your inquiry, allowing the inquiry to be linked to the statistical data of the visit. The legal basis for this is your consent (Article 6(1)(a) GDPR), which you may withdraw at any time without giving reasons; without consent no such identifier is created and none is transmitted.

In addition to the e-mail delivery described in Section 7, the Controller also transmits the inquiry data to its own internal analytics system ("Faedra Intelligence"). The purpose of this transmission is to keep a record of inquiries and to determine which marketing channel an inquiry came from; the data transmitted comprise the data you entered on the form (name, e-mail address, phone number, message and the other answers given) and the source data described above. The system is operated by the Controller itself; it is hosted by Render (hosting) and its data are stored by Supabase (database service; the data are stored in Ireland), both acting as processors — see Section 7. The legal basis of the transmission is Article 6(1)(b) GDPR as regards receiving and answering your inquiry, and the Controller's legitimate interest described above (Article 6(1)(f) GDPR) as regards source attribution and measuring the effectiveness of its marketing activity.

Providing your data is voluntary; however, completing the mandatory fields is a precondition of answering your inquiry. Retention: if no contract results from the inquiry, the data are erased 12 months after the last substantive contact; this retention period applies to every copy of the inquiry data, including the copy held in the Controller's internal analytics system. If a contract is concluded, further processing is governed by the separate notice applicable to the contractual relationship. The fact of your privacy declaration may be retained in a verifiable form until the end of the general civil-law limitation period (5 years), based on the principle of accountability (Article 5(2) GDPR).

4.Newsletter and project updates

If you expressly request it by ticking the corresponding checkbox on the form, the Controller will send you newsletters and updates about the development by e-mail. For this purpose we process your name and e-mail address.

The legal basis of this processing is your consent (Article 6(1)(a) GDPR and Section 6 of Act XLVIII of 2008 on Commercial Advertising). Giving consent is voluntary, is not a condition of answering your inquiry, and may be withdrawn at any time without giving reasons, via the unsubscribe option included in every newsletter or by writing to faedrahomes@oc.hu. Withdrawal does not affect the lawfulness of processing before the withdrawal.

Retention: until consent is withdrawn. Upon unsubscribing, your data are deleted from the newsletter database without delay.

5.Operating the Website, server logs

When serving the Website, the hosting and content-delivery infrastructure (Vercel) may record technical log data: IP address, the address of the page requested, browser and operating-system type, and the time of the visit.

The purpose of this processing is the secure and reliable operation of the Website and the detection and prevention of abuse; its legal basis is the Controller's legitimate interest to this end (Article 6(1)(f) GDPR). Log data are stored for a short period, typically no more than 30 days depending on the provider's settings, and are used solely for error and incident investigation.

6.Web analytics and bot protection

Google Analytics 4 (web analytics): the Controller uses Google Analytics 4 to measure Website traffic. The measurement code is loaded, and measurement cookies are set, only if you have expressly consented via the Website's cookie banner; without consent the Website transmits no data whatsoever to Google. The purpose is to measure traffic and how the Website is used; the legal basis is your consent (Article 6(1)(a) GDPR). Consent may be withdrawn at any time without giving reasons by changing your cookie settings; withdrawal does not affect the lawfulness of processing before the withdrawal. The individual cookies, their lifetimes and Google's processing are described in detail in the Cookie Notice.

Umami (cookieless web analytics): in addition to, and independently of, Google Analytics 4, the Controller also uses a cookieless statistics solution called Umami. The Controller does not use this as a third-party service: it operates the measurement system itself and the measurement data are stored in the Controller's own database, so the developer of the Umami software has no access to the measurement data and does not act as a processor. The system is hosted by Vercel (hosting) and the measurement data are stored by Supabase (database service; the data are stored in Ireland), both acting as processors — see Section 7.

Umami's tracking code places no cookie or other data on your device and reads no previously stored data from it: it distinguishes visitors server-side, by an identifier derived from the IP address, the browser identifier (user agent) and the Website's identifier. The processing of the IP address is transient in this context: it serves solely to produce that identifier. Because there is no storage on, and no reading from, your device, the consent requirement under Section 155(4) of Act C of 2003 on Electronic Communications does not apply to this measurement; the legal basis for the transient processing of the IP address is the Controller's legitimate interest (Article 6(1)(f) GDPR) in understanding the use of the Website and improving the service. Under the balancing test, the measurement is limited to producing aggregated traffic statistics, no individual visitor profile is created, visitors are not tracked across devices or websites, and the Controller does not use the measurement data for advertising. You may object to this processing at any time (see Section 10).

For the purposes of statistical measurement, the Website creates a randomly generated session identifier in the browser's session storage (sessionStorage) — but only if you have consented to statistical processing in the cookie banner — which links the visitor's interactions within the page. The legal basis for this is your consent (Article 6(1)(a) GDPR); without consent the Website neither creates nor stores such an identifier. When the form is submitted, this identifier is transmitted as described in Section 3.

Cloudflare Turnstile (bot protection): to protect the inquiry form against automated abuse, the Controller uses Cloudflare Turnstile. Turnstile processes technical signals (such as IP address and browser-environment characteristics) to distinguish humans from bots; the result of the check is verified by the Controller's server when the form is submitted, and where the check unambiguously fails the inquiry is not forwarded. The data are not used for advertising. The legal basis is the Controller's legitimate interest in the secure operation of the Website and the form (Article 6(1)(f) GDPR).

The Controller will announce any change in the scope or operation of the services described in this section by updating this notice and the Cookie Notice.

7.Recipients, data processors

The data submitted via the inquiry form are accessible to the Controller's sales staff and its appointed sales partner (Otthon Centum Solutions Kft., registered office: 1023 Budapest, Lajos utca 28-32., company registration number: 01-09-728100), solely for the purpose of handling your inquiry. The form data may also be forwarded to the Controller's customer-relationship-management (CRM) system ([CRM PROVIDER NAME]). As described in Section 3, the inquiry data are also transmitted to the Controller's own internal analytics system ("Faedra Intelligence"); that system is not provided by a third-party supplier — to run it, the Controller uses the hosting and database providers identified in the table below.

The Controller uses the following data processors:

Processors act solely on the Controller's instructions, under data-processing agreements pursuant to Article 28 GDPR. The Controller may disclose data to competent authorities only where required by law.

8.Transfers to third countries

Certain providers listed in Section 7 (Mailgun, Vercel, Cloudflare, Google, Render) may process data outside the European Economic Area, primarily in the United States. Such transfers are safeguarded by the standard contractual clauses adopted by the European Commission (SCCs, Article 46(2)(c) GDPR) and, where the provider is a certified participant, by the adequacy decision for the EU–U.S. Data Privacy Framework (Article 45 GDPR).

Under the database service provided by Supabase, the stored data are located within the European Economic Area, in Ireland; that processing therefore does not in itself constitute a transfer to a third country. Should the provider nonetheless access the data from outside the European Economic Area — in particular in the course of its support activity — such access is governed by the safeguards described in the previous paragraph.

A copy of, or reference to, the applicable safeguards is available on request at faedrahomes@oc.hu.

9.Data security

The Controller protects personal data with technical and organisational measures appropriate to the risk (Article 32 GDPR): traffic of the Website and the form is encrypted (TLS/HTTPS), the data are accessible only to authorised persons bound by confidentiality, processing is limited to the minimum necessary for the purpose, and the Website does not store the form data in a database of its own but transmits them to the recipients identified in Sections 3 and 7.

10.Your rights

In connection with the processing of your personal data you have the following rights:

• access (Article 15 GDPR): you may request information on which of your data we process and for what purpose, and request a copy;
• rectification (Article 16 GDPR): you may request the correction of inaccurate data and the completion of incomplete data;
• erasure ("right to be forgotten", Article 17 GDPR): you may request erasure where the data are no longer needed, you have withdrawn your consent, or the processing is unlawful;
• restriction of processing (Article 18 GDPR);
• data portability (Article 20 GDPR): you may receive the data processed by automated means on the basis of consent or contract in a structured, commonly used, machine-readable format;
• objection (Article 21 GDPR): on grounds relating to your particular situation you may object at any time to processing based on legitimate interest; we will then only continue if compelling legitimate grounds so require;
• withdrawal of consent (Article 7(3) GDPR): where processing is based on consent, you may withdraw it at any time without giving reasons, without affecting the lawfulness of processing before the withdrawal.

Requests may be submitted at faedrahomes@oc.hu or via the contact details in Section 1. The Controller will comply without undue delay and at the latest within one month; this period may be extended by up to two further months where necessary in view of the complexity of the request, of which you will be informed. Exercising your rights is, as a rule, free of charge.

11.Remedies

If you consider that the processing of your personal data infringes the GDPR or the Hungarian Privacy Act, we ask that you first contact the Controller at the details above. We will seek to remedy your complaint as soon as possible. You are also entitled to lodge a complaint with the supervisory authority:

• Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH)
• Address: Falk Miksa utca 9–11., 1055 Budapest, Hungary
• Postal address: 1363 Budapest, Pf. 9., Hungary
• Phone: +36 (1) 391-1400
• E-mail: ugyfelszolgalat@naih.hu
• Website: www.naih.hu

You may also bring the matter before a court (Article 79 GDPR, Section 23 of the Hungarian Privacy Act); the action falls within the competence of the regional courts (törvényszék) and may, at your choice, also be brought before the regional court of your place of residence or stay.

12.Automated decision-making, profiling

In connection with the Website, the Controller does not carry out decision-making based solely on automated processing producing legal effects within the meaning of Article 22 GDPR, and does not engage in profiling.

13.Cookies and similar technologies

Detailed information on the cookies used on the Website, including their categories, lifetimes and how to change your consent, is provided in the Cookie Notice. Non-essential cookies are only set with your prior consent.

14.Amendments to this notice

Version 1.1 of this notice is effective from 30 July 2026; this amendment documents the actual use of the web analytics (Google Analytics 4) and bot protection (Cloudflare Turnstile) processing previously described as planned, the introduction of cookieless web analytics (Umami), the processing of the marketing source data attached to an inquiry, and the transmission of data to the Controller's internal analytics system together with the processors used for it. The Controller may amend the notice unilaterally, in particular upon a change in the scope of its processing operations or changes in law; the version currently in force is always available on this page, with amendments indicated by the version number and the date of the update. Material changes will be announced conspicuously on the Website.