Privacy notice for hosts
All Access Budapest
Version 2.0 | 22 October 2026
Scope and sources
This notice covers hosts applying to All Access Budapest, property operators and their contacts, including trials, the host portal and payouts. Data comes from you or your organisation; technical and acceptance records arise from service use. A separate notice covers guest-page visitors.
Controller
Ikram Invest Kft. Registered office: 1188 Budapest, Határ utca 16., Hungary. Company registration number: 01-09-428154. Tax number: 32514502-2-43. Representative: Richárd Márki. Privacy: privacy@allaccessbudapest.hu. General enquiries: info@allaccessbudapest.hu.
Applications and service delivery
We process organisation or host name, contact name, email, supplied phone number, apartment name, address, district, unit count, preferred language and submitted notes. Host-supplied guest messages, house rules and guest content are published in the guide; include other people’s data only with an appropriate legal basis. The stored private apartment address is excluded from public guest-page data. We use these records to assess applications and run accounts, guides and QR materials. GDPR Article 6(1)(b) applies to individual contracting hosts. Article 6(1)(f) applies to organisation contacts, based on our legitimate interest in business communication and contract administration. Missing required details may prevent the application or service. Unnecessary notes are optional.
Authentication and acceptance records
Account records include email, display name, role, organisation and status. Authentication can involve password hashes, session and one-time token hashes, expiries, verification and failed-login records. Trials have a separate expiring session. Acceptance records contain email, organisation, terms and privacy versions, timestamp, acceptance context and browser user-agent. Acknowledging a notice does not provide blanket consent. Authentication serves delivery of the requested service; acceptance evidence and security records serve our legitimate interests in preventing abuse and establishing legal claims. Login cookies are necessary for the authenticated service, not marketing.
Payout details and recipients
We request payout and tax information only when collecting payout details, not during registration or trial activation. For individuals this includes name, address, tax identification number, bank account and tax declarations. A Hungarian TAJ social security number is requested only where a statutory reporting obligation for that payout requires it. Businesses provide name, registered office, tax number, bank account and invoice details. Article 6(1)(b) covers payouts to individual contracting hosts; Article 6(1)(c) covers mandatory accounting and tax processing, including Hungarian Act C of 2000 and applicable tax laws. Missing required details prevents payout. The bank receives transfer details, the accountant receives necessary accounting records, and the tax authority receives mandatory reports. Authorities and courts receive data only with an appropriate legal basis.
Retention and statistics
Necessary account and contract data is processed during the relationship; records needed for legal claims are retained for five years after termination. Accounting documents and supporting records are retained for at least eight years under section 169 of Hungarian Act C of 2000; other tax records follow applicable statutory periods. Expired credentials cannot be used for further access; unnecessary authentication records are deleted. Property-level totals of guest-page opens and clicks support service evaluation and settlement. These are not a named guest register. Hosts receive no guest names or contact details through this measurement.
Processors and international transfers
Vercel hosts and serves the websites; Neon provides the database. They access the data needed for these tasks. Their international infrastructure may involve processing outside the EEA. Applicable processing agreements, adequacy decisions or European Commission standard contractual clauses provide the relevant safeguards. Information and copies of the applicable safeguards can be requested at privacy@allaccessbudapest.hu. We do not sell personal data. Developers and advisers may access only what their tasks require, subject to confidentiality and appropriate contractual terms.
Security and your rights
We use HTTPS and access controls. Subject to GDPR conditions, you may request access, correction, erasure and restriction. You may object to legitimate-interest processing on grounds relating to your particular situation. You can withdraw consent at any time without affecting earlier lawful processing. Portability applies to automated processing based on consent or a contract. Statutory retention obligations may prevent immediate deletion. Contact privacy@allaccessbudapest.hu. We respond without undue delay and within one month; where necessary we may extend this by two further months, explaining the extension within the first month. Identifying session records may require additional necessary information; we do not collect new data solely to identify you.
Complaints and changes
You may complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9–11., Hungary; https://www.naih.hu. Contact email: ugyfelszolgalat@naih.hu. See the authority’s website for formal complaint procedures. You may also seek a judicial remedy. Changes are published on the relevant service; hosts are also directly informed of material changes. We do not make solely automated decisions producing legal or similarly significant effects.
Supplement to published version 2.1 – 22 October 2026
The version 2.0 text from commit 84bc409 is reproduced unchanged above. We use Resend to deliver account and service emails; it receives the recipient email address, necessary message content and delivery data. The delivery queue records status, attempts and the provider message identifier. A pre-created account activation link is single-use and remains valid until activation or revocation; only its hash is stored. Issuing a replacement invalidates the previous link. After the first password and required declarations are saved, we send a successful activation email. This is a service message, not marketing, and does not itself establish a separate email-confirmed contract. Details of the applicable infrastructure contractual safeguards are available from our privacy contact.