Effective: 1 August 2026
Privacy notice
This notice explains how Kalkó Hajnalka, sole proprietor, processes the personal data of persons interested in Bérlőmester services, clients, property owners, sellers, tenants, buyers, prospective clients and other contacts.
The controller accepts the contents of this notice as binding and undertakes to process personal data in connection with its activities in accordance with applicable data protection laws. Personal data is treated confidentially and reasonable technical and organisational measures are taken to ensure its security.
1. Details of the controller
Controller: Kalkó Hajnalka e.v.
Brand name: Bérlőmester
Registered office: 2167 Vácduka, Ady Endre út 16.
Tax number: 91770561-1-33
Registration number: 61866232
Website: berlomester.hu
Email: info@berlomester.hu
No data protection officer has currently been appointed. Questions, requests or complaints concerning data protection may be submitted using the contact details above.
2. Applicable legislation
The processing is governed in particular by the following legislation:
- Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR);
- Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information;
- Hungarian Act V of 2013 on the Civil Code;
- Hungarian Act C of 2000 on Accounting;
- Hungarian Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing, where applicable to the relevant real estate transaction;
- other applicable Hungarian and European Union legislation relating to the controller’s activities and the relevant legal relationship.
3. Key definitions
Personal data: any information relating to an identified or identifiable natural person, such as a name, contact details, address, identification number, financial data or property-related information.
Data subject: the natural person to whom the personal data relates.
Processing: any operation performed on personal data, in particular collection, recording, organisation, storage, use, disclosure, correction, restriction or deletion.
Controller: the person who determines the purposes and means of processing personal data.
Processor: a person who processes personal data on behalf of and according to the instructions of the controller.
Recipient: a person or entity to whom personal data is disclosed.
Consent: a freely given, specific, informed and unambiguous statement or action by which the data subject agrees to the processing of personal data.
Personal data breach: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
4. Data protection principles
The controller processes personal data:
- lawfully, fairly and transparently;
- only for specified, explicit and legitimate purposes;
- only to the extent necessary for the purpose;
- as accurately and up to date as reasonably possible;
- only for as long as necessary or required by law;
- with appropriate protection against unauthorised or unlawful access, use, alteration, loss or destruction.
5. Processing activities
5.1. Contact, enquiries and requests for quotations
Data subjects: owners, sellers, tenants, buyers and other persons contacting the controller about the services.
Data processed: name, phone number, email address, address, type and key characteristics of the property, content of the enquiry, and any other information voluntarily provided.
Purpose: communication, answering questions, providing a quotation, arranging appointments and preparing a contract.
Legal basis: taking steps at the request of the data subject prior to entering into a contract; consent for additional information voluntarily provided.
Retention: if no contract is concluded, generally for one year after the last substantive contact; if a contract is concluded, the data may become part of the relevant contractual processing.
5.2. Agency, brokerage and property management agreements
Data subjects: property owners, sellers, authorised persons, representatives and contacts.
Data processed: name, residential address or registered office, birth data, mother’s name, contact details, type and identification details of identity document, tax identification number or tax number, bank details, ownership and property data, power of attorney, billing data, and details of the engagement, fees and performance.
Purpose: entering into and performing the contract, communication, documenting the engagement, accounting for fees, and arranging the letting, management or sale of the property.
Legal basis: performance of a contract, compliance with a legal obligation and, where justified, the legitimate interests of the controller or client, in particular evidence of performance and handling legal claims.
Retention: generally five years after termination of the contract, or any longer period required by law.
5.3. Tenants, buyers and persons interested in a property
Data processed: name, phone number, email address, housing or purchase requirements, planned moving date, relevant circumstances regarding use of the property, offers and communications. If a contract is concluded, personal identification, address, identity document, billing and payment data required for the contract may also be processed.
Purpose: recommending a suitable property, arranging viewings, communication between the parties, and preparing and documenting a tenancy or sale process.
Legal basis: steps prior to entering into a contract at the data subject’s request; performance of a contract; where necessary, legitimate interests, in particular protecting the owner’s rights and documenting viewings.
Retention: in the event of an unsuccessful enquiry, generally one year from the last substantive contact; if a legal relationship is established, for the period applicable to the contract and legal obligations.
5.4. Tenancy, property management and monthly accounting
Data processed: the owner’s and tenant’s contact and contractual details, rent, deposit, condominium charges, utilities, meter readings, payments, arrears, statements, property inspections, fault reports, maintenance and related communications.
Purpose: performance of the tenancy and property management engagement, tracking payments and accounts, remedying faults, protecting the condition of the property and communication between the parties.
Legal basis: performance of a contract; legal obligation; where justified, legitimate interests, in particular protection of the property and contractual rights.
Retention: five years after the end of the legal relationship; accounting records and anti-money-laundering documents are retained for the period required by applicable law.
5.5. Property advertising, photographs and presentation
Data processed: address or area of the property, technical and legal characteristics, floor plan, photographs, videos, price or rent, contact details required for the listing and other information approved by the owner.
Purpose: presenting and advertising the property, reaching interested persons and managing viewings and offers.
Legal basis: performance of the contract with the property owner. Where images show an identifiable person or personal belongings not necessary for the listing, the controller seeks to remove or obscure them or obtain appropriate consent.
Publication: the listing may appear on property portals, social media and other advertising platforms selected for performance of the engagement.
Retention: until the listing is closed and thereafter for as long as necessary to evidence performance and handle legal claims; it will be removed from public platforms within a reasonable time after closure.
5.6. Preparation and conduct of a property sale
Data processed: ownership, property and contact details, offers, viewing and negotiation data, and information required for the energy performance certificate, electrical safety inspection, repairs, painting, clearance, transport or other assistance.
Purpose: preparing, advertising and presenting the property for sale, managing offers, coordinating with professionals and legal advisers, and supporting the sale process.
Legal basis: performance of a contract; where necessary data is disclosed to a professional, performance of the contract or the data subject’s legitimate interest following prior information.
Retention: five years after termination of the contract, unless the law provides otherwise.
5.7. Billing, accounting and payments
Data processed: name or company name, address or registered office, tax number, billing email address, service, fee, performance and payment data, and bank details.
Purpose: issuing invoices, accounting, compliance with tax and accounting obligations, and management of outstanding receivables.
Legal basis: compliance with a legal obligation and performance of a contract.
Retention: at least eight years for accounting documents, or the period required by the accounting and tax rules in force.
5.8. Anti-money-laundering customer due diligence
In the course of professional brokerage of property ownership and rental brokerage transactions specified by law, the controller may be subject to customer due diligence and record-keeping obligations.
Data processed may include: personal identification and document data required by law, address, nationality, authority to represent, beneficial ownership information, politically exposed person declaration, purpose and nature of the business relationship, risk classification and required documents or copies.
Purpose and legal basis: compliance with legal obligations concerning the prevention of money laundering and terrorist financing.
Retention: generally eight years from termination of the business relationship or completion of the occasional transaction, or longer where required by an authority or law.
5.9. Legal claims, complaints and disputes
Data processed: contracts, correspondence, statements, payment and performance data, photographs, records and other evidence generated in the matter.
Purpose: investigating complaints, enforcing claims and establishing, defending or settling legal claims.
Legal basis: legitimate interests of the controller or a third party, or a legal obligation.
Retention: until the claim is finally concluded and until the end of the applicable limitation and document retention periods.
5.10. Telephone calls
The controller does not record incoming or outgoing telephone calls. Notes may be made of information provided during a call where necessary to perform the service; the rules of the relevant contact or contractual processing apply to such notes.
5.11. Website use and technical log data
The website currently does not contain user registration, an online quotation request form or a contact form. Visitors to the English-language website are requested to make contact by email.
The hosting provider may process technical log data for the secure and reliable operation of the website, including in particular IP address, time of visit, URL visited, certain technical characteristics of the browser and device, and error and security logs.
Purpose: operation and IT security of the website, detection of errors and prevention of misuse.
Legal basis: the legitimate interests of the controller and hosting provider in secure website operation.
Retention: for the period necessary under the hosting provider’s current logging and security rules.
5.12. Cookies
The current version of the website does not use its own analytics, advertising or profiling cookies and does not use tracking code to monitor visitor behaviour. The browser or hosting provider may process data strictly necessary for secure technical operation.
If analytics, advertising, embedded social media or other consent-based technologies are added later, the controller will update this notice and, where necessary, the cookie consent system before use begins.
5.13. External links and Facebook
The website may contain links to external websites, in particular the Bérlőmester Facebook page. By opening such a link, the visitor leaves the Bérlőmester website and subsequent processing is governed by the external provider’s own privacy terms. Bérlőmester is not responsible for independent processing by external websites.
5.14. Direct marketing, newsletters and automated decision-making
The controller currently does not operate a newsletter system, carry out automated profiling or make decisions based solely on automated processing that produce legal or similarly significant effects for the data subject.
If separate marketing communications are introduced in the future, data subjects will be informed in advance of the applicable conditions and consent will be requested where required.
6. Recipients and processors of personal data
Personal data may be accessed by the controller and, where necessary, authorised staff, contractors and processors, solely to the extent required to perform their tasks.
For performance of the service or compliance with a legal obligation, personal data may in particular be disclosed to:
- hosting, domain and email providers;
- accountants, billing or financial service providers;
- banks or payment service providers;
- lawyers, notaries, bailiffs or other legal professionals;
- property portals and social media providers;
- utility providers, condominium managers and common representatives;
- energy assessors, electrical safety inspectors, photographers, repairers, maintenance staff, cleaners, painters, movers or other property-related professionals;
- authorities, courts or other bodies entitled by law to request data.
The controller seeks in every case to disclose only data necessary for the task. Providers are responsible for their own independent processing under the rules applicable to them.
As a rule, the controller does not transfer personal data to recipients outside the European Economic Area. Certain external online services, such as social media platforms, may process data outside the EEA as part of their independent processing; the relevant provider’s notice applies.
7. Storage and security of personal data
Personal data is processed on computers and mobile phones used by the controller and protected by appropriate access controls, in email systems, on service-provider servers and, where necessary, on paper. The place of processing and storage is not necessarily the same as the controller’s registered office.
The controller applies measures proportionate to the risks, including:
- using password-protected or otherwise access-controlled devices and accounts;
- restricting access to persons who require it for their tasks;
- seeking to keep software and security solutions up to date;
- storing paper records away from unauthorised persons;
- protecting data against unauthorised access, alteration, transmission, disclosure, deletion, damage and destruction;
- taking the measures required by law in the event of a personal data breach and, where necessary, notifying the supervisory authority and the data subject.
Complete security of data transmitted over the internet and by email cannot be technically guaranteed. Nevertheless, the controller takes reasonable measures to reduce the risks.
8. Rights of data subjects
8.1. Right to information and access
A data subject may ask whether their personal data is being processed and may request access to the data, purposes, legal basis, retention period, recipients and other material circumstances of processing. A copy of the personal data may also be requested without adversely affecting the rights and freedoms of others.
8.2. Right to rectification
The data subject may request correction of inaccurate data and completion of incomplete data.
8.3. Right to erasure
The data subject may request deletion of personal data, particularly where it is no longer needed, consent has been withdrawn and there is no other legal basis, processing is unlawful, or deletion is required by law. Deletion cannot be requested, among other cases, where retention is necessary for compliance with a legal obligation or for legal claims.
8.4. Right to restriction of processing
The data subject may request restriction where accuracy is contested, processing is unlawful but deletion is opposed, the controller no longer needs the data but the data subject needs it for legal claims, or the data subject has objected while the assessment is pending.
8.5. Right to data portability
Where processing is based on consent or contract and is carried out by automated means, the data subject may be entitled to receive data provided by them in a structured, commonly used and machine-readable format and request transmission to another controller where technically feasible.
8.6. Right to object
The data subject may object at any time, on grounds relating to their particular situation, to processing based on legitimate interests. The controller will then cease processing unless compelling legitimate grounds override the data subject’s interests, rights and freedoms, or processing is required for the establishment, exercise or defence of legal claims.
8.7. Withdrawal of consent
Where processing is based on consent, the data subject may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
9. Handling data subject requests
Requests may be sent to info@berlomester.hu or another contact address of the controller listed above.
The controller will provide information on action taken without undue delay and generally within one month of receiving the request. Taking account of complexity and number of requests, this period may be extended by a further two months in accordance with the law; the data subject will be informed of the extension and reasons within one month.
Information and action are generally free of charge. Where a request is manifestly unfounded or excessive, particularly because of its repetitive character, the controller may charge a reasonable fee or refuse to act. If there are reasonable doubts about identity, additional information necessary for identification may be requested.
10. Remedies
A data subject may first contact the controller directly with any complaint concerning processing using the contact details in this notice.
The data subject has the right to lodge a complaint with the supervisory authority:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9–11.
Postal address: 1363 Budapest, Pf. 9.
Email: ugyfelszolgalat@naih.hu
Phone: +36 1 391 1400
Website: www.naih.hu
The data subject may also apply to a court if they believe that processing of their personal data infringes their rights. Subject to legal conditions and at the data subject’s choice, proceedings may also be brought before the court of the data subject’s residence or place of stay.
11. Other provisions and changes to this notice
The data subject is responsible for ensuring that information provided is accurate and truthful and that another person’s personal data is disclosed to the controller only on an appropriate legal basis.
If the controller introduces new processing not described in this notice, data subjects will be appropriately informed at or before collection.
The controller may amend this notice in response to changes in services, technology, actual processing practices or law. The current version is always available on this page and states its effective date.