← All Access Budapest

Privacy and cookies

Technical visitor privacy notice for allaccessbudapest.hu, budapesthungary.info, allaccessmap.hu and the account portals. Detailed host privacy and contractual terms are linked below.

Technical notice version: 2026-10-22.2 · 2026-10-22

Privacy notice for guests

Published version: guest-privacy-2.1-20261022-en

Privacy notice for guests

All Access Budapest

Version 2.0 | 22 October 2026

Scope

This notice covers visitors to the budapesthungary.info guest guides and the allaccessmap.com map. No account, name, email or phone number is required. A separate notice covers hosts.

Controller

Ikram Invest Kft. Registered office: 1188 Budapest, Határ utca 16., Hungary. Company registration number: 01-09-428154. Tax number: 32514502-2-43. Representative: Richárd Márki. Privacy: privacy@allaccessbudapest.hu. General enquiries: info@allaccessbudapest.hu.

Measuring guide opens and clicks

The guide uses a random session identifier. Event records include property ID and slug, available QR identifier, language code and timestamp. Opens also record QR or direct source; clicks record event type, destination website and offer ID where available. The session identifier is pseudonymous, not automatically anonymous. Measurement supports service analysis and property-attributed traffic reporting. Our event tables do not store IP addresses or names; technical website delivery is separate.

Browser storage and consent

The aab_attribution_session identifier is stored in sessionStorage, normally until the tab closes; browser session restoration may affect this. Closing the tab does not delete events already sent to the server. Non-essential statistical measurement and its browser storage require prior consent, under GDPR Article 6(1)(a). Refusing consent must not prevent access to guest content. Withdrawal can also be requested at privacy@allaccessbudapest.hu. We do not use Google Analytics or Meta Pixel tracking code.

Maps and location

Location access starts only when you request it and permit it in your browser, under GDPR Article 6(1)(a). Your browser uses coordinates and accuracy to position the map; coordinates are sent to overpass-api.de to find nearby places. Map tiles load from tile.openstreetmap.org, so OpenStreetMap infrastructure receives request details such as IP address and requested map area. Browser permission can be revoked and the map can be browsed manually. We do not store location in our event tables. Opening an external directions service may send the destination and, depending on the link, starting coordinates to that service.

External links and technical delivery

Opening an offer takes you to a booking service such as GetYourGuide, Tiqets, WeGoTrip or Radical Storage. Links may contain affiliate or offer identifiers. The receiving service also obtains technical request information and processes it under its own privacy notice. We do not send guest names or contact details. Vercel may process IP addresses and request details to deliver and protect the site, based on our legitimate interest in operation and abuse prevention under GDPR Article 6(1)(f).

Retention

Measurement events are retained for no more than 13 months, then deleted or irreversibly anonymised into aggregate statistics. Browser location is used for the requested feature; we do not build a persistent location history. Technical delivery records are retained as necessary for operation and security, subject to specific incidents or legal obligations. External map and booking providers apply their own retention policies.

Processors and international transfers

Vercel hosts and serves the websites; Neon provides the database. They access the data needed for these tasks. Their international infrastructure may involve processing outside the EEA. Applicable processing agreements, adequacy decisions or European Commission standard contractual clauses provide the relevant safeguards. Information and copies of the applicable safeguards can be requested at privacy@allaccessbudapest.hu. We do not sell personal data. Developers and advisers may access only what their tasks require, subject to confidentiality and appropriate contractual terms.

Security and your rights

We use HTTPS and access controls. Subject to GDPR conditions, you may request access, correction, erasure and restriction. You may object to legitimate-interest processing on grounds relating to your particular situation. You can withdraw consent at any time without affecting earlier lawful processing. Portability applies to automated processing based on consent or a contract. Statutory retention obligations may prevent immediate deletion. Contact privacy@allaccessbudapest.hu. We respond without undue delay and within one month; where necessary we may extend this by two further months, explaining the extension within the first month. Identifying session records may require additional necessary information; we do not collect new data solely to identify you.

Complaints and changes

You may complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9–11., Hungary; https://www.naih.hu. Contact email: ugyfelszolgalat@naih.hu. See the authority’s website for formal complaint procedures. You may also seek a judicial remedy. Changes are published on the relevant service; hosts are also directly informed of material changes. We do not make solely automated decisions producing legal or similarly significant effects.

Supplement to published version 2.1 – 22 October 2026

The version 2.0 text from commit 84bc409 is reproduced unchanged above. The current public map address is allaccessmap.hu. Cookie settings can be reopened at any time; Necessary only immediately stops further statistics and removes the local measurement identifier. Each domain has its own choice. Statistics start only after a current permission has been successfully logged. A daily deletion job enforces a maximum 13-month retention for visitor events and cookie-choice records. Necessary cookies, choice logs and external services are described in the technical supplement below.

Guest privacy notice PDF

Technical supplement and cookies

Controller and contact

Ikram Invest Kft. · Company registration 01-09-428154 · Tax number 32514502-2-43. Contact: info@allaccessbudapest.hu; privacy requests: privacy@allaccessbudapest.hu. Full published company details are in the detailed notice.

Necessary storage

The aab_session login cookie lasts up to 7 days (12 hours for administrators). It contains no password. The host-only aab_privacy cookie stores your choice, version, expiry and random receipt identifiers for 180 days. A language preference may be stored locally as aab-guide-language until deleted. These support requested functions and remember choices; they do not enable statistics. Account services rely on contract performance; security and consent records support legal obligations and legitimate security interests.

Optional statistics

Only after permission do we measure guest-guide opens and outbound clicks: public page/property and QR identifiers, language, QR/direct source, time, click type and destination domain. A random session identifier, aab_attribution_session, lives in sessionStorage until the tab closes. Events contain no name, email or private apartment address. Basis: consent under GDPR Article 6(1)(a). The acquisition site and map currently run no separate visit analytics. We do not start marketing trackers.

Choices and records

Choose Necessary only or Accept Cookies. Reopen Cookie settings at any time; Necessary only immediately stops further measurement and removes the local analytics identifier. Withdrawal does not affect prior lawful processing. A random identifier, site, policy version, analytics choice and server timestamp are logged, without linking them to an account or email. A choice lasts at most 180 days; policy version changes request a new choice. Each domain has its own choice. Storage or logging failures leave statistics disabled.

Maps and external providers

OpenStreetMap tiles and Overpass nearby searches receive technical network information such as IP addresses. Browser location requires separate permission; nearby searches use rounded coordinates. We do not save precise location in our statistics. Google Maps directions, venue sites and GetYourGuide, Tiqets, WeGoTrip and Radical Storage offers open external sites with their own privacy practices and possible affiliate attribution. Remote image providers receive network information when images load. Our statistics permission does not authorise these providers' tracking.

Providers and retention

Hosting: Vercel Inc.; database: Neon PostgreSQL; account/service email: Resend. See the detailed notice for processors and international transfers; details of the actual contractual safeguards are available from our privacy contact. Visitor events and cookie-choice records are deleted by a daily job after at most 13 months. Browser preferences can be deleted at any time. Contract declarations are separate records and are not withdrawn through cookie settings. Technical security/hosting logs are separate from optional visit analytics.

Your rights

You can request information, access, correction, erasure, restriction and, where applicable, portability; you may object to legitimate-interest processing and withdraw consent at any time. Contact privacy@allaccessbudapest.hu; the random receipt identifier in the cookie may help locate a cookie record. You can complain to Hungary's NAIH (naih.hu) and seek judicial redress.

Host terms

Browsing the guide or map does not require accepting a host contract. Host signup and the first mandatory password change of a pre-created account require separate terms acceptance and acknowledgement of reading the privacy notice. Their time, document versions and text hashes are retained. These declarations do not enable statistics. Physical-product orders are currently requests; final price, delivery and payment require separate agreement.