Legal
Privacy notice
Last updated · 22 September 2026
This is what personal data we handle, why, for how long, and what you can do about it. It is short, because we handle very little.
Who handles it
The controller is the operator of this site named below, reachable at the email address given.
What we handle and why
The name, email address, telephone number and message you type into the contact form. The purpose is answering your enquiry; the legal basis is your consent, given by sending the form. The sender's IP address appears on one line of the notification email we receive, so that abuse can be recognised; it is not written to the site's own store — it stays in our mailbox with that email and goes when the email goes. Separately, the server's access log and the services' operational logs record the IP address a request came from, the time of the request, the address requested and the browser identifier — for secure operation, on the basis of our legitimate interests (Article 6(1)(f) GDPR). These logs are rotated by size: a closed log file is kept for at most seven days.
How long we keep it
Enquiries stay in our mailbox and in the site's own store until the matter is closed, and at most two years. Deletion is not automatic: we delete the enquiry ourselves in the admin interface. The store moves older enquiries into a yearly archive file, which the admin list no longer shows; what remains there we have deleted on request by the provider who runs the system. If an enquiry becomes a contract, accounting retention periods apply instead.
Who else sees it
We do not sell it and we do not pass it on for marketing. It reaches exactly as far as running the site requires: the email provider and the hosting provider — and, where switched on for this site, the services described separately below.
Email delivery
The site's emails — such as the notice of an enquiry to the office and the confirmation sent to the visitor — are delivered by Scaleway SAS (Paris, France), within the European Economic Area and solely for delivery.
The AI recommender
A question put to the site's recommender — together with the conversation so far — goes to an external AI provider, which produces the answer: OpenAI (OpenAI Ireland Ltd., Dublin, Ireland). Only the public details of the listings travel with it. The recommender asks for no name and no email address, and the site does not store what a visitor asks: the browser sends the history along with each question, and the server discards it once the answer is out. If a visitor speaks a question instead of typing it, their own browser turns the speech into text — using the browser vendor's service — and the site receives only the text. The provider uses the submitted text to produce the answer, does not use it to train its models, and keeps it for at most thirty days to detect abuse. Where it also processes the data outside the European Economic Area, this rests on the European Commission's standard contractual clauses, which form part of the provider's data processing agreement, or on the EU–US Data Privacy Framework.
Live customer chat
If a visitor asks for a person in the conversation, what has been said so far and every later message is kept in the site's own store, so that a colleague can carry on and the office can read it back later — along with the page and the listing where the conversation started. The chat asks for no name and no contact details; a visitor who wants a reply by email gives it on the contact form, and it is handled as an enquiry under the rules above. The legal basis is the visitor's request that started the conversation. A conversation is not deleted automatically: it stays in the store until the office deletes it in the admin — and a visitor can ask for that at any time.
The footage behind the page
The footage behind this site is served by a content delivery network (veduta.b-cdn.net — BunnyWay d.o.o., Slovenia): the visitor's browser fetches it from there, so that server sees the visitor's IP address — solely to deliver the file; it sets no cookie and does not track. For a browser that asks for data saving or reduced motion, the footage is not downloaded at all.
Cookies
There is no analytics or advertising cookie on this site. Cookies are used only for administrator sign-in: the session cookie, and a short-lived cookie for the middle step of two-step sign-in. A visitor never receives either. In the browser's own storage we keep only what the visitor has chosen about the display — such as light or dark mode and the quality of the 3D view — and, until the tab is closed, the fact that a pop-up message has already been seen. None of this identifies anyone, and none of it reaches us.
Your rights
You may ask for a copy of what we hold about you, for it to be corrected or deleted, for the processing to be restricted, and for your data in a portable form. You may object to processing based on legitimate interests — the logs, for example — and you may withdraw consent at any time; withdrawal does not affect the lawfulness of the processing carried out before it. We answer within one month at the latest. Complaints go to the Hungarian data protection authority (NAIH, 1055 Budapest, Falk Miksa utca 9-11., naih.hu), and you may also go to court: proceedings may be brought before the regional court for the place where you live or stay.
Controller
Hosting provider
Scaleway SAS, 8 rue de la Ville-l'Évêque, 75008 Paris, France