PRIVACY NOTICE

At Home Management Kft.

This Privacy Notice provides information about the processing of personal data by At Home Management Kft. in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter: GDPR) and applicable Hungarian data protection legislation.

1. DATA CONTROLLER

The Data Controller is At Home Management Korlátolt Felelősségű Társaság (At Home Management Kft.; hereinafter: Data Controller).

Company details:

• Registered office: 1022 Budapest, Fillér utca 53., Building B, 2nd floor, Door 2, Hungary
• Company registration number: 01-09-199692
• Tax number: 25100035-2-41
• Representative: Zoltán Mező
• Telephone: +36 70 930 3820
• E-mail: management@athome-network.com

The Data Controller has not appointed a Data Protection Officer. Data protection-related inquiries may be submitted using the contact details provided above.

2. CATEGORIES OF PERSONAL DATA PROCESSED

In connection with inquiries, contractual relationships and property management services, the Data Controller may process the following categories of data:

• Name and contact details, including telephone number and e-mail address
• Property address, characteristics, parameters and other information necessary for property management
• Floor plans, photographs and videos of the property
• Information necessary for preparing, concluding and performing contracts
• Correspondence and administrative information related to the property management service

Property-related information, floor plans, photographs and videos may constitute personal data where they identify or can be linked to an identifiable natural person.

Data disclosed to third parties where necessary:

• Name and contact details required for the relevant service
• Property address and technical information necessary for the performance of the relevant task
• Floor plans, photographs or videos, where necessary and legally permitted

The Data Controller processes personal data for the purpose of providing property management services, communicating with clients, preparing and performing contracts, and carrying out property-related administrative activities.

Providing certain personal data may be necessary for concluding or performing a contract. Without such information, the Data Controller may be unable to provide the requested service or may only be able to provide it to a limited extent.

Signing the Contract of Engagement confirms acknowledgement of this Privacy Notice. Such acknowledgement does not constitute consent to processing where another legal basis applies.

3. PURPOSES OF DATA PROCESSING

The Data Controller processes personal data for the following purposes:

3.1. Property management services

Performing property management tasks, arranging maintenance and repairs, communicating with property owners, tenants and service providers, and preparing and performing related contracts.

3.2. Communication and administration

Maintaining contact with clients, contractual partners, tenants and interested parties, handling inquiries and carrying out administrative activities related to managed properties.

3.3. Newsletter and electronic communications

Sending newsletters, information about property management services, professional news and market trends to individuals who have provided the required consent.

3.4. Statistical analysis and service development

Preparing aggregated statistics and analyses for improving property management services. Where possible, the Data Controller uses anonymised information that does not identify individuals.

3.5. Compliance with legal obligations

Fulfilling accounting, taxation, record-keeping and other obligations imposed by applicable legislation.

4. LEGAL BASIS FOR DATA PROCESSING AND DATA TRANSFERS

The Data Controller processes personal data only where an appropriate legal basis exists under Article 6 of the GDPR.

Depending on the purpose, the legal basis may be:

• Article 6(1)(b) GDPR – Performance of a contract: Processing necessary for entering into or performing a contract with the data subject.
• Article 6(1)(c) GDPR – Legal obligation: Processing necessary for compliance with applicable legal requirements.
• Article 6(1)(a) GDPR – Consent: Processing based on the data subject’s freely given, specific, informed and unambiguous consent, particularly in relation to newsletters where consent is required.
• Article 6(1)(f) GDPR – Legitimate interests: Processing necessary for legitimate business interests, such as certain administrative, security and communication activities, provided that those interests are not overridden by the rights and freedoms of the data subject.

The Data Controller processes personal data only for specified, explicit and legitimate purposes and does not process such data for incompatible purposes without an appropriate legal basis.

Data transfers

Personal data may be disclosed to third parties where necessary for performing property management services, complying with legal obligations or pursuing other purposes supported by an appropriate legal basis.

Recipients may include:

• Maintenance and repair professionals
• Condominium managers
• Utility and other service providers
• Contractual partners involved in property management
• Accounting, legal and administrative service providers, where applicable
• Competent authorities where disclosure is required by law

Only personal data necessary for the relevant task may be disclosed. Recipients must comply with applicable data protection and confidentiality requirements.

Where the processing is based on consent, the data subject may withdraw consent at any time without affecting the lawfulness of processing carried out before its withdrawal.

5. DURATION OF DATA PROCESSING

The Data Controller retains personal data only for as long as necessary to fulfil the purposes for which the data was collected, subject to applicable legal retention requirements.

Contract-related data

Personal data processed in connection with contractual relationships is retained for the duration of the contractual relationship and subsequently for the period necessary to comply with legal obligations or establish, exercise or defend legal claims.

Accounting documents

Accounting documents are retained for eight years in accordance with Section 169(2) of Act C of 2000 on Accounting.

Newsletter subscriptions

Personal data processed for newsletter communications is retained until the data subject withdraws consent or unsubscribes, unless continued limited retention is necessary to demonstrate compliance with legal requirements.

Inquiries and correspondence

Personal data collected through inquiries and correspondence is retained only for the period necessary to respond to the inquiry and for any further period justified by applicable legal obligations or legitimate interests.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised unless further processing is required or permitted by law.

6. ACCESS TO PERSONAL DATA AND DATA PROCESSORS

Personal data may be accessed only by authorised employees, representatives and service providers of the Data Controller to the extent necessary for their assigned responsibilities.

The Data Controller uses an external hosting provider for the technical operation and hosting of its IT infrastructure.

Hosting provider and data processor:

• Company name: Rackforest Informatikai Kereskedelmi Szolgáltató és Tanácsadó Zártkörűen Működő Részvénytársaság
• Short name: Rackforest Zrt.
• Registered office: 1132 Budapest, Victor Hugo utca 11., 5th floor, B05001, Hungary
• Company registration number: 01-10-142004
• Tax number: 32056842-2-41
• E-mail: info@rackforest.hu
• Website: https://rackforest.com/

Purpose of data processing by the hosting provider:

Provision and technical operation of server and hosting infrastructure, including the storage and technical processing of data necessary for the Data Controller’s services.

Categories of data concerned:

Personal data stored in or processed through the systems hosted on the relevant infrastructure, including contact details, contract-related information and other data necessary for property management activities.

Duration of processing:

For the duration of the hosting service relationship and in accordance with applicable contractual data retention, backup and deletion requirements.

Rackforest Zrt. acts as a data processor within the scope of the hosting services provided and processes personal data in accordance with the Data Controller’s documented instructions and the requirements of Article 28 of the GDPR.

The Data Controller implements appropriate contractual, technical and organisational safeguards to protect personal data processed by external service providers.

Any transfer of personal data outside the European Economic Area, if applicable, must comply with Chapter V of the GDPR and be subject to appropriate legal safeguards.

7. RIGHTS OF DATA SUBJECTS

Under the GDPR, data subjects have the following rights, subject to the applicable legal conditions:

• Right of access: To obtain confirmation of whether their personal data is being processed and to access such data.
• Right to rectification: To request correction of inaccurate personal data or completion of incomplete data.
• Right to erasure: To request deletion of personal data where the applicable legal requirements are met.
• Right to restriction of processing: To request restriction of processing in certain circumstances.
• Right to data portability: To receive personal data in a structured, commonly used and machine-readable format and, where applicable, request its transfer to another controller.
• Right to object: To object to processing based on legitimate interests and to processing for direct marketing purposes.
• Right to withdraw consent: To withdraw previously given consent at any time.

Requests concerning personal data may be submitted to:

E-mail: management@athome-network.com

Telephone: +36 70 930 3820

The Data Controller shall respond to requests without undue delay and, in principle, within one month of receipt. This period may be extended by up to two additional months where necessary, taking into account the complexity and number of requests. The data subject shall be informed of any extension and the reasons for it within the initial one-month period.

Newsletter recipients may unsubscribe at any time using the unsubscribe link included in newsletter communications.

8. DATA SECURITY MEASURES

The Data Controller uses server and hosting infrastructure provided by Rackforest Zrt. for the storage and technical processing of personal data within the scope of the relevant hosting services.

The Data Controller applies appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration, disclosure, destruction or other unlawful processing.

Such measures are selected according to the nature of the processing and the associated risks and may include access controls, user authentication, appropriate system maintenance, backup arrangements and restrictions on access to personal data.

The Data Controller does not carry out solely automated decision-making, including profiling, that produces legal effects concerning data subjects or similarly significantly affects them.

9. COMPLAINTS AND LEGAL REMEDIES

If a data subject considers that the processing of their personal data infringes applicable data protection legislation, they may contact the Data Controller using the contact details provided in Section 1.

The data subject also has the right to lodge a complaint with the competent supervisory authority.

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

• Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
• Postal address: 1363 Budapest, P.O. Box 9, Hungary
• Telephone: +36 1 391 1400
• E-mail: ugyfelszolgalat@naih.hu
• Website: https://www.naih.hu/

The data subject also has the right to seek an effective judicial remedy before a competent court in accordance with applicable legislation.

ACKNOWLEDGEMENT

By signing below, I acknowledge that I have received and read this Privacy Notice and have been informed about the processing of my personal data by At Home Management Kft.

This acknowledgement does not replace any separate consent that may be required for specific processing activities.

Date: ______________________________

Name: ______________________________

Signature: ______________________________