General privacy notice
In force from: 2026-08-17
This is the general privacy notice for the processing carried out by Kling Ond József egyéni vállalkozó, provided in order to satisfy the right to transparent information.
I. Introduction and the legislation this processing is based on
In drawing up this Privacy Notice, Kling Ond József egyéni vállalkozó took into account primarily Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation – GDPR), and the provisions of Act CXII of 2011 on informational self-determination and freedom of information (Infotv.). For advertising sent by electronic means (newsletter), § 6 of Act XLVIII of 2008 on the basic conditions and certain limitations of commercial advertising activity (Grt.) also applies. This notice serves to fulfil the information obligation laid down in that legislation.
II. Details of the controller
- Controller: Kling Ond József egyéni vállalkozó (hereinafter: the Controller)
- Registered seat / postal address: Szigetcsárda utca 1.
- Sole trader registration number: to be completed
- Tax number: to be completed
- Estate agency registration number: to be completed
- Email: [email protected]
The Controller is not required to appoint a data protection officer.
III. Legal basis of the processing
In all of its processing the Controller acts by identifying one of the legal bases laid down in law. The Controller may therefore process personal data on one of the following legal bases:
- necessary for entering into or performing a contract,
- necessary for compliance with a legal obligation,
- necessary for the legitimate interests of the controller or a third party,
- on the basis of the data subject’s consent,
- necessary to protect the vital interests of the data subject or of another natural person.
In the individual notices for each processing operation the Controller identifies the legal basis specifically (see section X).
IV. Purpose of the processing
In all of its processing the Controller collects personal data solely for a lawful and clearly identifiable purpose. In the individual notices for each processing operation the Controller identifies the purpose specifically.
V. Categories of personal data
The Controller distinguishes personal data by source: data obtained from the data subject and data not obtained from the data subject. In the individual notices for each processing operation the Controller identifies the source and the categories of personal data specifically. No automated decision-making or profiling takes place in any of the processing operations.
VI. Envisaged duration of the processing
The Controller processes personal data for the period prescribed by law or necessary for the purpose of the processing. In the individual notices for each processing operation the Controller identifies the storage period specifically.
VII. Recipients of personal data in the event of a transfer
The Controller may transfer the personal data it processes as provided by law. Transfers to a third country are expressly identified, naming the recipient and stating how the safeguards laid down in law are ensured.
Processors engaged:
- Cloudflare, Inc. — making the website available (Cloudflare Tunnel) and email forwarding; privacy notice
- Resend (Plus Five Five, Inc.) — email delivery (confirmation, newsletter); privacy notice
- Hosting provider: to be completed: name, registered seat, contact
The providers above are established in the United States. Appropriate safeguards for the transfer are provided by certification under the EU–US Data Privacy Framework and/or the standard contractual clauses (SCC) adopted by the European Commission.
The Controller does not sell personal data and does not transfer it for the marketing purposes of third parties.
VIII. Rights of the data subject
Right to transparent information
The data subject must be informed of the identity and contact details of the controller and its representative, of the purpose and legal basis of the processing, where applicable of the recipients of the personal data, and of any transfer of personal data to a third country. The Controller must provide all information in a concise, transparent, intelligible and easily accessible form, in clear and plain language, free of charge. Where processing is intended for a purpose other than the original one, the Controller must inform the data subject of that other purpose and of all relevant further information before that further processing.
On a request to exercise data subject rights, the Controller informs the data subject without undue delay and in any event within one month of receipt of the request; that period may be extended by a further two months where necessary, taking into account the complexity of the request, and the Controller notifies the data subject of the extension and its reasons within the first month. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, the Controller may charge a reasonable fee or refuse to act; the burden of demonstrating this lies with the Controller. Where the Controller has reasonable doubts about the identity of the person making the request, it may request further information necessary to confirm it.
Right of access
The data subject is entitled to obtain confirmation as to whether their personal data are being processed and, if so, to access them. The Controller must provide a copy of the personal data undergoing processing free of charge; for further copies it may charge a reasonable administrative fee. Where the request is made by electronic means, the information must be provided in a commonly used electronic form, unless the data subject requests otherwise.
Right to rectification
The data subject may request rectification of inaccurate personal data concerning them, and — by means of a supplementary statement — completion of incomplete personal data. The Controller carries out the rectification without undue delay.
Right to erasure (right to be forgotten)
The data subject may request erasure of data concerning them. The right to erasure is not absolute, so the Controller complies with the request only where one of the following grounds applies:
- the personal data are no longer necessary for the purpose for which they were collected,
- the data subject withdraws consent and there is no other legal basis for the processing,
- the data subject objects to the processing and there is no overriding legitimate ground,
- the personal data have been unlawfully processed,
- the personal data must be erased for compliance with a legal obligation.
The Controller refuses erasure where the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims.
Right to restriction of processing
The data subject may request restriction of processing where they contest the accuracy of their personal data; where the processing is unlawful but they oppose erasure; where the Controller no longer needs the data but the data subject requires them for legal claims; or where they have objected to the processing. Personal data subject to restriction may only be stored by the Controller.
Right to data portability
The data subject may request that the personal data concerning them which they have provided to the Controller be handed over in a structured, commonly used, machine-readable format, or transmitted directly to another controller where technically feasible. This right may be exercised only in respect of processing based on consent or on the necessity of entering into or performing a contract.
Right to object
The data subject may object at any time, on grounds relating to their particular situation, to the processing of their personal data where the legal basis is the legitimate interest of the controller or of a third party. Following an objection the Controller may no longer process the personal data, unless it demonstrates compelling legitimate grounds which override the interests of the data subject, or the processing relates to the establishment, exercise or defence of legal claims.
For direct marketing (newsletter) the right to object is unconditional: where the data subject objects to processing for direct marketing purposes, their personal data may no longer be processed for that purpose. This can be done with a single click on the unsubscribe link at the bottom of every newsletter.
IX. Remedies
Supervisory authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9–11., phone: +36 (1) 391-1400, email: [email protected], naih.hu.
Court proceedings: the data subject has the right to an effective judicial remedy against the controller or the processor. Proceedings may also be brought before the regional court of the data subject’s place of residence or stay.
X. Specific processing operations on this website
1. Contact form
Data processed: name, email address and/or phone number, the text of the message, and the identifier of the property you wrote about. As technical data, the time of submission, the browser identifier (user agent) and a one-way, irreversible digest (hash) of the IP address — the IP address itself is not stored.
Purpose: answering the enquiry and keeping in contact; the hash serves solely to filter out abusive, automated submissions.
Legal basis: consent (GDPR Art. 6(1)(a)); for abuse filtering, legitimate interest (GDPR Art. 6(1)(f)) in keeping the service operational.
Duration: at most 2 years, or until consent is withdrawn.
2. Newsletter
Data processed: email address, optionally name, the time of subscription and of confirmation, the page the subscription came from, a hash of the IP address and the browser identifier.
Purpose: direct marketing — information about new properties and about the market.
Legal basis: consent (GDPR Art. 6(1)(a), Grt. § 6). Subscription uses double opt-in: the address is added to the list only after you click the link in the confirmation email. The fact and time of confirmation are stored as evidence of consent (GDPR Art. 7(1)).
Duration: until you unsubscribe, after which the fact and time of unsubscription are retained in order to demonstrate lawfulness.
Unsubscribing: one click at the bottom of every email, free of charge. Subscribing to the newsletter is never a condition of any other service.
3. Cookies
The site uses no marketing or analytics cookies and runs no third-party tracking code. Cookies are used solely by the administrative login (a session cookie), which does not affect visitors. There is therefore no cookie banner on the site: strictly necessary cookies require no consent.
4. Map and fonts
Fonts are served from our own server, so using them sends no data to a third party. The map is the exception: the base map tiles in the map view load directly into your browser from OpenStreetMap/CARTO, so that provider can see your IP address. The cadastral parcel layer, by contrast, is served through our own server precisely so that no data leaks about it.
5. Exercising your rights
You can exercise the rights listed in section VIII by writing to [email protected]. Consent may be withdrawn at any time; withdrawal does not affect the lawfulness of processing carried out beforehand.