1. The Data Controller

A Strzebonski Sam Michiel, sole proprietor(commercial name:Invest Home) (seat/official mailing address:8330 Sümeg, Csalogány Street 1.; registration number:56226946; tax number:57585077-1-39; electronic contact:info@investhome.hu; website address:www.investhome.hu; phone number:+36 70 649 4473, hereinafter referred to as: Data Controller) informs the users of its services below about the data processing it applies, in accordance with the relevant legal provisions governing the protection of personal data.

The Data Controller pays special attention to the protection of personal data, therefore it always ensures fair and transparent data management, the basic requirement of which is the provision of appropriate information regarding the processing of data. This Data Management Notice provides, among other things, information on the processing of personal data by the Data Controller in the course of providing its services and processing data for advertising purposes: the sources and scope of access to the processed data, the legal basis, purpose and duration of data processing, the rights related to personal data and the choices between them, and also includes the contact details where the Data Subject can get answers to questions related to the Data Controller's data protection practices.

2. Concepts

Property owner (seller/landlord):A person who is the owner of the property brokered by the Data Controller, or the holder of the property right (e.g. usufruct right) relating to the property, or who has concluded an agency contract with the Data Controller for the brokerage of the property, and their authorized representative.

Bidder (buyer/lessee):A person who has made an offer to purchase/rent a property brokered by the Data Controller.

Viewer:A person who has viewed the property mediated by the Data Controller or who has been provided with the exact address of the mediated property by the Data Controller.

Property search:In addition to the above, any person who, within the scope of the Data Controller's real estate brokerage activities, requests information from the Data Controller in person, by telephone, electronically or otherwise, or makes inquiries, including in particular contacting the Data Controller for the purpose of selling or purchasing, or who registers with the Data Controller as a property seeker.

Newsletter subscriber:A person who has subscribed to the Data Controller's newsletter service.

Assistance service user:A person who has used a support service on the website.

Affected: The users of the various services of the Data Controller are affected by the processes related to the processing of personal data carried out by the Data Controller: Property owner, Bidder, Property searcher, Newsletter subscriber, Support service user, Job applicant, Valuation commissioner to the Data Controller.

3. Purpose of data processing

3.1. For property seekers:The Data Controller shall search for and recommend a property that meets the specified conditions sought by the Data Subject for purchase/rental purposes, and shall establish a connection between the person wishing to sell/rent the property and the Data Subject.

3.2. For viewers:The Data Controller should be able to show the Data Subject a property that meets the specified conditions and is sought for purchase/rental.

3.3. In the case of a property owner:Fulfillment of the agency contract concluded between the Data Subject and the Data Controller, under which the Data Controller facilitates the sale/lease of the property by sharing the property data with other real estate agents and/or displaying it on various advertising platforms.

3.4. In case of customer due diligence obligation:Fulfillment of the Data Controller's customer due diligence obligation. Fulfillment of the Data Controller's legal obligation [GDPR Article 6 (1) c)] ??and Sections 6 - 9 of Act LIII of 2017 on the Prevention and Combating of Money Laundering and the Financing of Terrorism (Pmt.).

3.5. In the case of a bidder:recording the purchase/rental offer for the property mediated by the Data Controller and forwarding it to the Property Owner.

3.6. In case of valuation:Performance of the valuation contract concluded between the Data Subject and the Data Controller.

3.7.In case of sending newsletters:Sending newsletters containing professional information regarding the real estate market and promotions, offers and promotions within the framework of the Data Controller's advertising activities.

3.8. Sin case of fulfilling the customs duty:Fulfillment of the data controller's obligation to retain documents.

3.9. For job applicants:Assessment of applicants for job advertisements at the Data Controller.

4. Legal basis for data processing

4.1. For property seekers:Legitimate interest of the Data Controller [GDPR Article 6(1)(f)]. The Data Controller has a legitimate interest in providing a high level of property search services, ensuring that customers are satisfied with its services, and thereby increasing its turnover.

4.2. For viewers:Legitimate interest of the Data Controller [GDPR Article 6(1)(f)]. The Data Controller has a legitimate interest in providing a high level of real estate search services, ensuring that customers are satisfied with its services, and thereby increasing its turnover by presenting the property to those interested in the property.

4.3. In the case of a property owner:Performance of a contract [GDPR Article 6(1)(b)].

4.4. In case of customer due diligence obligation:Compliance with a legal obligation applicable to the data controller [GDPR Article 6(1)(c)] and Sections 6 - 9 of Act LIII of 2017 on the Prevention and Combating of Money Laundering and the Financing of Terrorism (Pmt.).

4.5. In the case of a bidder:Data processing necessary for steps prior to entering into a contract [GDPR Article 6(1)(b)].

4.6. In case of valuation: Performance of a contract [GDPR Article 6(1)(b)].

4.7.In case of sending newsletters:Consent [GDPR Article 6(1)(a)].

4.8. Sin case of fulfilling the customs duty:Compliance with a legal obligation applicable to the data controller [GDPR Article 6 (1) (c)] and Section 169 of Act C of 2000 on Accounting.

4.9. For job applicants:Consent of the data subject [Article 6(1)(a) of the GDPR].

5. Scope of processed data

5.1. For property seekers:name, address (if provided by the data subject), telephone number, email address, and data provided by the Data Subject regarding the property sought [e.g. purchase price of the property, location, nature, aspect, useful floor area, construction method, comfort level, heating method, number of rooms, or plot area], payment schedule (ratio of own funds and loan).

5.2. For viewers:name, place and time of birth, mother's birth name, address, telephone number, e-mail address, data necessary for the accurate identification of the property viewed.

5.3. In the case of a property owner:name, place and date of birth, mother's birth name, address, or, failing that, place of residence, telephone number, e-mail address, data provided regarding the property [e.g. photograph of the property, floor plan, general description of the property, purchase price of the property, location, nature, aspect, useful floor area, construction method, comfort level, heating method, room number, or plot area].

5.4. In case of customer due diligence obligation:surname and first name, surname and first name at birth, citizenship, place and time of birth, mother's birth name, address, or, if not available, place of residence, type, number and copy of identification document, prominent public figure statement, statement indicating the source of the purchase price.

5.5. In the case of a bidder:name, place and date of birth, mother's birth name, address, or, if not available, place of residence, telephone number, e-mail address, bid amount and terms of payment.

5.6. For valuation purposes:name, place and date of birth, mother's birth name, address, or, failing that, place of residence, telephone number, e-mail address, data provided regarding the property [e.g. photograph of the property, floor plan, general description of the property, purchase price of the property, location, nature, aspect, useful floor area, construction method, comfort level, heating method, room number, or plot area].

5.7.In case of sending newsletters:name, business email address.

5.8. Sin case of fulfilling the customs duty:Accounting documents supporting accounting records

5.9. For job applicants:name, place and date of birth, address, telephone number, email address and other data provided in the biography.

6. Duration of data processing

6.1. For property seekers:5 years from the date of recording of personal data.

6.2. For viewers:5 years from the date of recording of personal data.

6.3. In the case of a property owner:5 years from the termination of the contract.

6.4. In case of customer due diligence obligation:for 8 years from the date of recording of personal data.

6.5. In the case of a bidder:5 years from the date of recording of personal data.

6.6. For valuation purposes:5 years from the termination of the contract.

6.7.In case of sending newsletters:until the Data Subject withdraws their consent.

6.8. Sin case of fulfilling the customs duty:The Data Controller is obliged to retain personal data related to the fulfillment of its obligation to retain documents for eight years.

6.9. For job applicants:1 year from the date of recording of personal data.

7. Recipients of personal data and categories of recipients, publication and creation of a statistical database

7.1 [Data Processors]The Data Controller transfers the Data Subject's data to its contracted partners (including private individuals) for data processing during the provision of the service, in order to perform it, and to the extent necessary for that purpose. The data processors and their categories, which are among the Data Controller's contracted partners and which are used in order to perform the service and to carry out marketing/advertising activities, and by whom the Data Subject's data is processed, are: ingatlanszoftver.hu, ingatlan.com, magyarhosting.hu.

7.2. [Transfer of personal data]In addition to its real estate brokerage activities, the Data Controller provides assistance to the Data Subjects in connection with a service provided by another data controller, for which the Data Subject has a need. In such cases, the Data Controller provides the Data Subject's contact details (usually name, address, e-mail address and telephone number) to the service providers, which may be: a credit broker, an appraiser, a lawyer, a specialist authorized to issue energy certificates, a company that produces 3D images of real estate. The Data Controller receives precise information about the name and contact details of the service provider during the data transfer.

In the case of the Property Owner Data Subjects, a database is created and data is transferred for statistical purposes.

7.3. [Disclosure of personal data]The Data Controller draws attention to the fact that in order to facilitate the sale of the property, the data provided regarding the property [e.g. photo of the property, floor plan, property description, purchase price of the property, location, nature, aspect, useful floor area, construction method, comfort level, heating method, number of rooms, or plot area] will be published on various online advertising platforms.

Please note that no data regarding the exact address of the property will be transmitted, including the house number or topographical number of the property.

8. Security of personal data and the scope of persons having access to personal data

8.2. The Data Controller ensures the security of the processed data and takes all measures to prevent unauthorized access, alteration, transmission, disclosure, deletion or destruction, as well as accidental destruction and damage, as well as inaccessibility resulting from changes in the technology used, i.e. in order to ensure that the personal data of the Data Subjects are protected in accordance with the law.

8.3. The Data Controller, within the scope of the measures necessary to maintain the data security requirement, processes the Data Subject's data in a computer database, automatically and manually, and has ensured that the Data Subject's data is processed in a closed and in all cases password-protected system, saved on a hard drive, and these systems are only used in connection with the provision of the service, to the extent absolutely necessary, by those authorized to view the data.

8.4. The Data Controller's employees and contractual partners involved in the provision of its services are entitled to access personal data.

8.5. The Data Controller ensures that those authorized to access the data are fully informed about data protection rules. As a guarantee of data security, the Data Controller, its employees and its contractual partners involved in the provision of its services are subject to a confidentiality obligation and legal liability with respect to personal data obtained in the course of their activities.

9. Your rights and the rules governing the exercise of rights

9.1. Upon request of the Data Subject, the Data Controller shall provide information in writing or electronically [GDPR Article 15(1); right to information]:

• about what data we process about you,

• the purposes of data processing,

• the categories of recipients to whom we may disclose personal data,

• the duration of data processing,

• about your rights and legal remedies.

9.2. Before initiating the procedures regulated in this point, the Data Subject is entitled to contact the Data Controller with a complaint - which can be submitted electronically - in order to eliminate his/her concerns related to data processing and to restore the legal status. The Data Controller shall examine the complaint within one month, make a decision on its merits, and inform the Data Subject of its decision in writing and electronically. If the Data Controller determines that the Data Subject's complaint is well-founded, it shall restore the legal status of data processing or terminate the data processing - including further data collection and data transmission. In such a case, the Data Controller may no longer process the Data Subject's data, unless the Data Controller proves that the data processing is justified by compelling legitimate reasons which override the interests, rights and freedoms of the Data Subject, or which are related to the presentation, enforcement or defense of legal claims. The Data Controller will notify those to whom the data subject to the complaint was forwarded about the complaint and the measures taken based on it.

9.3. Upon request of the Data Subject, the Data Controller shall provide a copy of the personal data in a commonly used electronic format or in another format chosen by the Data Subject. [Article 15(3) of the GDPR; right of access, right to obtain a copy].

9.4. We will modify and clarify your personal data in accordance with the request of the Data Subject. [Article 16 of the GDPR; right to rectification]. In order to exercise your right to access your data and correct your personal data, you may contact the Data Controller by sending an e-mail to info@investhome.hu.

9.5. Upon request of the Data Subject, the Data Controller shall erase the Data Subject's personal data. The Data Controller may refuse to comply with the request for the reasons set out in Article 17(3) of the GDPR, for example where the personal data are necessary for the establishment, exercise or exercise of legal claims, or for compliance with an obligation under Union or Member State law to which the Data Controller is subject to, or for reasons of public interest or for the exercise of the right to freedom of expression and information. [Article 17 of the GDPR; right to erasure].

9.6. The Data Subject may withdraw his/her consent at any time, free of charge, without limitation or justification. or may report his/her request to prohibit the sending of advertising. In this case, the Data Controller shall immediately delete the name of the Data Subject and all other personal data from the register. The withdrawal statement may be made either by post, by letter sent to the registered office of the Data Controller, or electronically by sending a letter to the e-mail address info@investhome.hu [right to withdraw consent]. The withdrawal does not affect the lawfulness of the data processing carried out on the basis of consent before the withdrawal.

9.7. The Data Subject has the right to request the restriction (blocking) of the processing of personal data.

• if you dispute the accuracy of the personal data, you may request that the data be blocked for a period of time while the Data Controller verifies the accuracy of the personal data;

• if the processing is unlawful and the Data Subject opposes the erasure of the personal data and instead requests the restriction of their use;

• The controller no longer needs the personal data, but the data subject requests the blocking of the data for the establishment, exercise or defence of legal claims [Article 18 GDPR; right to restriction of processing (blocking)]

• The Data Controller shall comply with the request for blocking by storing the personal data separately from all other personal data. For example, in the case of electronic data files, it shall save them on an external data medium or move the personal data stored on paper to a separate folder. With the exception of storage, the Data Controller shall only process the data with the consent of the Data Subject, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for important public interest reasons of the Union or a Member State. We will inform you in advance about this lifting of the restriction of processing.

9.8. The Data Subject has the right to receive his/her personal data in a commonly used, machine-readable, structured format and has the right to transmit those data to another controller. In addition, the Data Controller shall ensure that, upon express request, the Data Subject's data are transmitted directly to another controller specified by the Data Subject. [Article 20(1) and (2) of the GDPR; right to data portability].

9.9. The Data Subject has the right to object at any time to the processing of his or her personal data based on the legal basis of balancing of interests [Article 6 (1) (f) GDPR]. In the event of an objection, the Data Controller shall examine whether, due to the facts and arguments cited by the employee, the Data Controller has the possibility to delete the personal data or terminate the data processing.

9.10. The Data Controller shall inform the Data Subject of the measures taken within one month of receipt of the Data Subject's request. In the event of refusal of the request, the Data Controller shall inform you within one month of receipt of the request of the reasons for the refusal and of the possibility of filing a complaint with the Authority and exercising your right to judicial remedy.

9.11. The exercise of the right is free of charge. In certain cases, the Data Controller may charge a fee based on administrative costs or may refuse to act on the request if the Data Subject requests a copy of his/her data or if the Data Subject's request is clearly unfounded or - in particular due to its repetitive nature - excessive.

9.12. The Data Controller reserves the right to request the provision of information necessary to confirm the identity of the Data Subject, if it has reasonable doubts regarding the identity of the person submitting the request. Such a case is considered to be in particular if the Data Subject exercises his/her right to request a copy, in which case it is justified for the Data Controller to verify that the request originates from the authorized person.

10. Your options for exercising your rights

If you believe that the data processing does not comply with the legal requirements, you may initiate proceedings with the National Data Protection and Freedom of Information Authority (Postal address: 1363 Budapest, Pf.: 9., e-mail address: ugyfelszolgalat@naih.hu). If you believe that the Data Controller has violated your right to the protection of personal data, you may go to court and initiate proceedings before the court of your place of residence or stay.