Purpose of this Notice
We have adopted this Notice to provide natural persons using our services and representatives of legal persons (all persons identified as data subjects, collectively referred to in certain parts of this Notice as “Users”) with all material information in a concise, transparent, intelligible and easily accessible form, using clear and plain language, and to assist Users in exercising the rights set out in section 4. Our services are available on the Birdhill Group project website (birdhillgroup.hu) and on the related Facebook and Instagram pages.
Our obligation to provide information is based on Article 12 of Regulation (EU) 2016/679 of the European Parliament and of the Council, applicable since 25 May 2018 (the “GDPR”), and section 4 of Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services.
This Notice has been prepared in consideration of the GDPR and other legislation relevant to the individual processing activities.
When preparing and applying this Notice, we have taken into account the findings in the recommendation of the Hungarian National Authority for Data Protection and Freedom of Information on the data-protection requirements for prior information, as well as Article 5 of the GDPR, in particular the accountability principle under Article 5(2).
We also monitor European Union practice concerning personal-data protection and incorporate into our processing practices the guidance on transparency issued by the European Commission’s Article 29 Working Party.
Data Controller details
Birdhill Group Korlátolt Felelősségű Társaság
Registered office: 1012 Budapest, Logodi utca 30, Hungary
Company registration number: 01-09-453560
Tax number: 32997000-2-41
Represented by: managing directors Bence Szabó and Balázs Mayer
Email: info@birdhillgroup.hu
Telephone: +36 20 292 5728
Individual data processing activities
This section describes the material circumstances of each processing activity that the GDPR and other sector-specific legislation require every data controller to disclose.
Enquiries and ongoing communication
Through the contact form on our Website and our Facebook and Instagram pages, interested persons may contact us about apartments offered for sale as part of the Birdhill Group property-development project. In addition, we process the personal data of contact persons at our business partners in the course of our work. Details of the related processing are set out below.
Personal data processed and purposes of processing
| Personal data | Purpose of processing | Legal basis for processing |
|---|---|---|
| Name | Identification of the User or the contact person of our business partner | The User’s consent (Article 6(1)(a) GDPR); for a business partner, legitimate interests (Article 6(1)(f) GDPR) |
| Email address | Making contact and maintaining communication with the User or the contact person of our business partner | The User’s consent (Article 6(1)(a) GDPR); for a business partner, legitimate interests (Article 6(1)(f) GDPR) |
| Telephone number | Making contact and maintaining communication with the User or the contact person of our business partner | The User’s consent (Article 6(1)(a) GDPR); for a business partner, legitimate interests (Article 6(1)(f) GDPR) |
| Public profile data available on a social-media platform | Identification of the User | The User’s consent (Article 6(1)(a) GDPR); for a business partner, legitimate interests (Article 6(1)(f) GDPR) |
Legal basis for processing
The User’s consent, given voluntarily and explicitly through an affirmative action when making contact (placing a telephone call or sending an email), to process their personal data for the purposes set out in section 3.1 (Article 6(1)(a) GDPR).
If we use a User’s data for a purpose other than the purpose for which it was originally collected, we inform the User, obtain their prior explicit consent and give them the opportunity to prohibit such use (see section 9.1).
We process the above personal data of our business partners’ contact persons on the basis of the legitimate interests of the Data Controller and our business partners (Article 6(1)(f) GDPR). It is in the legitimate interests of both parties to ensure effective business communication during use of the Website and in the course of partner discussions, and to be able to inform each other’s designated representative about any material circumstance affecting the contract between us. The contact person’s right to informational self-determination is not infringed because their employment or contractual duties include facilitating communication between the parties and providing their personal data for that purpose. The contact person of our business partner may object to this processing.
Duration of processing
We process the personal data provided until consent is withdrawn. The User may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
We process the personal data of our business partners’ contact persons for as long as necessary for communication and for as long as permitted by the relevant legislation (five years from performance or termination of the contract under Act V of 2013, and eight years from issuance of an invoice under Act C of 2000).
Method of processing
In electronic form.
What rights do Users have?
It is important to us that our processing complies with the requirements of fairness, lawfulness and transparency. This section briefly introduces the individual rights of data subjects; these rights are explained in more detail in Annex 3 to the Notice.
Users may request, free of charge, information about the details of the processing of their personal data; access those data; obtain a copy of the personal data processed; and, in the cases defined by law, request their rectification, erasure, blocking or restriction of processing, and object to the processing of such personal data. Requests for information and the requests described in this section may be sent to the contact details listed in section 2.
Right of access
Users may obtain confirmation from us as to whether their personal data are being processed and may access those personal data and the details of their processing, and obtain a copy of the personal data we process.
Right to rectification
At the User’s request, we will rectify inaccurate personal data concerning them without undue delay. The User is also entitled to have incomplete personal data completed, including by providing a supplementary statement.
Right to erasure
At the User’s request, we will erase personal data concerning them where we no longer need the data, the User withdraws consent or objects to the processing, or the processing is unlawful.
Right to be forgotten
Where the User so requests, we will endeavour to notify every data controller that has obtained, or may have obtained, any personal data of the User made public, of the User’s request for erasure.
Right to restriction of processing
At the User’s request, we will restrict processing where the accuracy of the personal data is contested, the processing is unlawful, the User objects to the processing, or we no longer require the personal data.
Right to data portability
Users may receive the personal data concerning them that they have provided in a structured, commonly used and machine-readable format, and may transmit those data to another data controller.
Right to object
Users have the right to object at any time, on grounds relating to their particular situation, to processing of their personal data based on legitimate interests (see section 3.1). In that event, we may no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override the User’s interests, rights and freedoms, or grounds connected with the establishment, exercise or defence of legal claims. As a general rule, following an objection the personal data may no longer be processed for that purpose.
Responses to requests
We examine a request and decide whether it is well-founded as soon as possible and no later than 30 days after submission—or 15 days in the case of an objection—and inform the applicant of our decision in writing. If we do not grant the request, our decision will state the factual and legal reasons for refusal.
Remedies
The protection of personal data is important to us and we respect Users’ right to informational self-determination. We therefore endeavour to respond to every request correctly and within the applicable deadline. With this in mind, before commencing proceedings before an authority or a court, we ask Users to contact us with any complaint or question so that any concern can be resolved as soon as possible.
If contacting us does not produce a satisfactory result, the User may:
- enforce their rights before a court under Act V of 2013 on the Civil Code. Proceedings may also be brought before the court with jurisdiction for the User’s place of residence or stay; a list of courts and their contact details is available at birosag.hu/torvenyszekek; and
- contact and lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information under the Hungarian Information Act (address: 1055 Budapest, Falk Miksa utca 9–11; postal address: 1363 Budapest, Pf. 9; telephone: +36 1 391 1400; fax: +36 1 391 1410; email: ugyfelszolgalat@naih.hu; website: naih.hu; the “NAIH”).
Our procedure for requests to exercise rights
Notification of recipients
We notify every recipient to whom the User’s personal data have been disclosed of any rectification, erasure or restriction of processing, unless this proves impossible or involves disproportionate effort. At the User’s request, we provide information about those recipients.
Form and deadline for providing information
We provide information about action taken on requests related to section 4 in electronic form—unless the User requests otherwise—no later than one month after receipt of the request. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months. We inform the User of any extension, together with the reasons for the delay, within one month of receiving the request.
At the User’s request, information may also be provided orally, provided that the User proves their identity by other means.
If we do not take action on a request, we inform the User no later than one month after receipt of the request of the reasons and of their right to lodge a complaint with the NAIH and seek a judicial remedy (section 4.9).
Verification
In exceptional cases, where we have reasonable doubts concerning the identity of the natural person submitting a request, we may ask for additional information necessary to confirm their identity. This measure is necessary to support the confidentiality of processing under Article 5(1)(f) GDPR—that is, to prevent unauthorised access to personal data.
Costs of information and action
Information provided and action taken in response to requests related to section 4 are free of charge.
Where a User’s request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee that reflects the administrative costs of providing the requested information or communication or taking the requested action, or we may refuse to act on the request.
Potential recipients of personal data and data processors
Website operation
The hosting provider, acting as a data processor, may access personal data provided while using the Website.
Name: DEFWEB Informatikai Korlátolt Felelősségű Társaság; company registration number: 13-09-209929
Contact details: registered office: 2030 Érd, Kont utca 3, Hungary; facebook.com/default.hu
Website development
The maintainer and developer of the Website, acting as a data processor, may access personal data provided while using the Website.
Name: Vieeye Online Marketing Korlátolt Felelősségű Társaság; registered office: 2051 Biatorbágy, Tulipán utca 17/a, Hungary; company registration number: 13-09-185120
Contact: vieeye.hu
Social media platforms
We maintain Facebook and Instagram pages in connection with our Website, including instagram.com/birdhillgroup. If, for example, a User “likes” our Facebook page or follows us on Instagram, we may see all personal data connected to their profile that are available to the public. Relevant information about processing on these pages is provided in the relevant service provider’s own privacy policy.
Joint processing with Meta Platforms Ireland Limited
Meta Platforms Ireland Limited (registered office: 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Irish company registration number: 462932; website: about.facebook.com/meta) provides Facebook—including the Facebook mobile application and its in-app browser—and Instagram—including the Instagram mobile application—as part of its Meta products. Depending on the specific purpose of processing, the terms of use, privacy policy and data-processing notice of Meta Platforms Ireland Limited apply to processing connected with the use of Facebook and Instagram.
- We and Meta Platforms Ireland Limited are jointly responsible for processing personal data for the purposes of creating audiences, delivering commercial and transaction-related messages, personalising features and content, and developing and improving the security of Meta products. The arrangements concerning the allocation of responsibilities for GDPR compliance and information on data transfers are available at:
facebook.com/legal/Workplace_GDPR_Addendum
Workplace European Data Transfer Addendum: workplace.com/legal/WorkplaceEuropeanDataTransferAddendum
Meta Platforms, Inc. and the EU–US and Swiss–US Data Privacy Frameworks: dataprivacyframework.gov - Within the joint processing arrangement, Meta Platforms Ireland Limited is primarily responsible for providing information about the processing and enabling data subjects to exercise their GDPR rights. Further information about the processing of personal data by Facebook and Instagram, as well as the related rights and options available to Users, is provided in Meta Platforms Ireland Limited’s privacy policy at facebook.com/about/privacy.
- Otherwise, each party is independently responsible for its own processing of personal data.
Our processing is based on the User’s consent in accordance with Article 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future by changing the preferences set in the cookie banner. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Data security
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, both when determining the means of processing and during processing itself, we implement appropriate technical and organisational measures—such as pseudonymisation—designed to implement data-protection principles, including data minimisation, effectively and to integrate into processing the safeguards necessary to meet GDPR requirements and protect the rights of data subjects.
Organisational measures
Access to our IT systems is granted through permissions attributable to an identified person. When permissions are assigned, the principle of “necessary and sufficient rights” applies: every employee may use our IT systems and services only to the extent necessary to perform their duties, with the corresponding permissions and only for the necessary period. Access to IT systems and services may be granted only to a person who is not subject to restrictions for security or other reasons, such as a conflict of interest, and who has the professional, business and information-security knowledge required for their secure use.
Technical measures
Except for data stored by our data processors, we store data on our own equipment in a data centre. IT equipment storing data is kept separately in a locked server room protected by a multi-stage access-control system based on authorisation.
We take all reasonable steps to ensure that our IT equipment and software continuously meet technological standards generally accepted in the market.
During development, we create systems in which operations can be controlled and traced through logging and incidents—such as unauthorised access—can be detected.
Our server is located securely and in isolation on the hosting provider’s dedicated server.
In consideration of the relevant recommendation of the NAIH, we operate the Website through an encrypted connection protected by an SSL certificate (HTTPS), which provides a higher level of data security than an unencrypted HTTP connection.
The Website’s content-management system (CMS) and the data stored in it are regularly backed up on the server. The CMS and installed extensions are continuously updated to reduce security risks, and the administration interface can be accessed only with password protection. Contact forms on the Website are also protected against automated unsolicited (spam) submissions by the reCAPTCHA service.
Cookies
To ensure the proper operation of our Website and to achieve our statistical and advertising purposes, in certain cases we place small data files (cookies) on the User’s computer or device, as do most modern websites. Cookies that are not strictly necessary are placed only with the User’s prior consent.
What is a cookie?
A cookie is a small text file that a website places on the User’s computer or device, including a mobile phone. It enables the website to “remember” the User’s settings—for example, language, font size and display preferences—so that they do not need to be set again each time the User visits our Website.
Cookies used on the Website:
| Cookie source | Cookie name | Cookie function | Cookie lifetime |
|---|---|---|---|
| System (Website) | PHP/session cookie | Strictly necessary—to provide the Website’s basic operation | Until the browser is closed |
| CookieScript | Cookie-consent storage | Strictly necessary—to remember the User’s cookie preferences | 1 year |
| Google Analytics 4 | e.g. _ga, _gid | Statistics—anonymised traffic measurement and analysis of user behaviour | 24 hours to 2 years |
| Google Ads | e.g. _gcl_au, IDE | Advertising/marketing—measurement of campaign performance and conversions; remarketing | 30 days to 2 years |
| Meta Pixel | e.g. _fbp, fr | Advertising/marketing—audience building, conversion measurement and remarketing | 30 days to 2 years |
| LinkedIn Insight Tag | e.g. bcookie, lidc, UserMatchHistory, li_sugr | Advertising/marketing—conversion measurement and anonymous professional/demographic analysis | 30 days to 2 years |
These cookies may be deleted or blocked, but the Website may not function properly in that case.
We do not use strictly necessary and statistical cookies to identify the User personally; they serve only the purposes described above. Advertising cookies, however—where the User has given prior consent—make it possible to recognise the User’s device and display personalised advertisements, including for audience building and remarketing.
Google Analytics
1. The Website uses Google Analytics 4 (GA4), a web-analysis service provided by Google LLC (“Google”). Google Analytics uses “cookies”, text files saved on the User’s computer, to help analyse how the User uses the Website. Google Analytics cookies—as statistical cookies—are loaded and activated only after the User has given prior opt-in consent through the CookieScript consent-management system in accordance with Google Consent Mode v2 requirements.
2. Information generated by cookies about the User’s use of the Website is normally transmitted to and stored on a Google server in the United States. When IP anonymisation is activated on the Website, Google truncates the User’s IP address within Member States of the European Union or other states party to the Agreement on the European Economic Area before transmission.
3. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there. On our behalf, Google uses this information to evaluate the User’s use of the Website, compile reports on Website activity for us, and provide other services relating to Website and internet use.
4. Google does not associate the IP address transmitted by the User’s browser within Google Analytics with other Google data. The User may prevent cookies from being stored by selecting the appropriate browser settings; however, some Website features may then not be fully available. The User may also prevent Google from collecting and processing data generated by cookies about their use of the Website, including the IP address, by downloading and installing the browser plugin available at tools.google.com/dlpage/gaoptout.
The User may modify or withdraw consent to Google Analytics cookies at any time, without restriction, through the CookieScript cookie-settings interface available on the Website.
Meta Pixel
Meta Pixel, formerly Facebook Pixel or Facebook Custom Audience, is an internet analytics and advertising service provided by Meta Platforms Ireland Limited. It enables the Data Controller to obtain information about how visitors use the Website. Meta Pixel—as an advertising/marketing cookie—is loaded and activated only after the User has given prior opt-in consent through the CookieScript consent-management system in accordance with Google Consent Mode v2 requirements. Further information about Meta Pixel cookies is available at facebook.com/policies/cookies and developers.facebook.com/docs/meta-pixel.
Use of the Meta Pixel service requires cookies to be placed on user devices. We use Meta Pixel on the Website for both advertising and Website analytics. Meta pixels place cookies on the device used to browse the Website for the purposes of building appropriate advertising audiences, measuring cross-device conversions, targeting and optimising advertisements for the appropriate audience, displaying personalised advertising, and preparing reports and statistics concerning Website and application traffic.
The User can control and configure Meta Platforms Ireland Limited’s processing in their Facebook and Google accounts and can choose whether to permit collection through Facebook cookies on the Website. After logging in to Facebook, the User can view these cookies in Facebook Ads Settings and configure or modify cookie preferences there. On the Website, the User may give or withdraw consent at any time, by cookie category, through the CookieScript cookie-settings interface.
Google Ads
The Website uses Google Ads, an advertising service provided by Google LLC (“Google”). Google Ads cookies—advertising/marketing cookies such as _gcl_au and IDE—are loaded and activated only after the User has given prior opt-in consent through the CookieScript consent-management system in accordance with Google Consent Mode v2 requirements. Google Ads cookies are used to measure advertising campaign performance and conversions and to display advertisements relevant to the User, including remarketing. Further information is available at ads.google.com/intl/en/home/faq. The User may modify or withdraw consent to Google Ads cookies at any time through the CookieScript cookie-settings interface available on the Website.
How can cookies be managed?
The User can primarily set preferences for cookies placed on the Website through the CookieScript cookie-settings interface—the cookie information banner—available on the Website. There, previously given consent may be modified or withdrawn at any time by cookie category.
Cookie files can also be deleted—detailed information is available at AllAboutCookies.org—or blocked by most modern browsers. In that case, however, certain settings may need to be configured again each time the Website is used, and some services may not function.
Detailed information about deleting and blocking cookies is available at AllAboutCookies.org and, for the User’s browser, at the following links:
Other provisions
Processing for a different purpose
If we intend to use the data provided for a purpose other than the original purpose of collection, we inform Users, obtain their prior explicit consent, and give them an opportunity to prohibit such use.
Record-keeping obligation
We maintain records of processing activities under our responsibility—a record of processing activities—in accordance with Article 30 GDPR.
Personal data breach
A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, personal data processed. In the event of a personal data breach, we act in accordance with Articles 33 and 34 GDPR. We document personal data breaches, including the facts relating to the breach, its effects and the remedial action taken.
Amendments
We may amend this Notice unilaterally at any time. If the Notice is amended, we retain earlier versions as in effect at the relevant time and—where possible and justified—draw the attention of data subjects to the amended provisions.
Effective date: 10 September 2026
| Birdhill Group Kft. / Data Controller |