Home Zone

Privacy Notice

This notice describes the actual processing carried out by the public Home Zone website. It does not cover staff who sign in to the office's internal system.

Effective: 2 September 2026.Version: 1.0

This English text is an informative translation of the Hungarian version. If the two differ, the Hungarian version prevails to the extent permitted by applicable law.

1. Controller and contact

The controller is BERNINA Kft. You may send a privacy question, rights request or security report to [email protected], or by post to the registered office. Please do not send passwords or unnecessary special-category data.

Full legal name: BERNINA Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság
Short legal name: BERNINA Kft.
Registered office: 3433 Nyékládháza, Fenyő utca 8. ajtó
Company registration number: 05-09-032556
Registering court: Miskolci Törvényszék Cégbírósága
Tax number: 22768078-2-05
Email: [email protected]
Telephone: +36 30 753 7317

2. Processing purposes

2.1. Browsing and server logs

Data processed: IP address, timestamp, request identifier, requested path and host, HTTP method and status, browser user agent, network edge region, response time and traffic volume.
Purpose: Delivering the site and images, availability, troubleshooting, information security and abuse prevention.
Legal basis: GDPR Article 6(1)(f): the legitimate interest in operating the service securely and reliably.
Source: The visitor's device and network connection.
Recipients and processors: Railway Corporation and its approved subprocessors; the BERNINA Kft. technical maintainer authorised for this purpose.
Transfer outside the EEA: Yes. The application and database run in Railway's US West region in California. Railway Corporation is an active participant in the EU-US Data Privacy Framework; its data-processing terms also incorporate the EU Standard Contractual Clauses.
Retention: Railway documents a 30-day retention period for HTTP logs on the Pro plan. BERNINA Kft. does not forward logs to a separate analytics service.
Access: Authorised hosting-provider personnel and BERNINA Kft.'s designated technical maintainer, only where necessary.
Required or optional: Processing the basic network data is necessary to use the site. Without it, the site cannot be delivered.

2.2. Enquiry about a listing

Data processed: Name, email address and/or telephone number, optional message, listing identifier, submission language, source page and timestamp, and a salted one-way hash of the sender's IP address. The enquiry record does not store the raw IP address.
Purpose: Receiving and answering the request about the selected property, preparing a viewing or further discussion, and limiting form abuse.
Legal basis: GDPR Article 6(1)(b): steps taken at the data subject's request before entering into a contract. For the security hash, GDPR Article 6(1)(f): the legitimate interest in protecting the form.
Source: Data entered by the visitor, the listing being viewed and the network connection.
Recipients and processors: BERNINA Kft. staff handling enquiries and Railway Corporation as processor. When replying by email or telephone, the parties' communications providers also transmit the message or call.
Transfer outside the EEA: The safeguards described in section 2.1 apply to Railway's processing in the USA. An email's route may depend on the sender's and recipient's providers.
Retention: We retain the enquiry for as long as necessary to handle it and resolve the resulting relationship. If it leads to a contract or dispute, related data may be kept for the general five-year limitation period for legal claims. There is no single automatic deletion date for every enquiry; the data subject may request earlier deletion unless an overriding legal basis applies.
Access: The enquiry enters the office's intake screen. Access is limited to staff handling the request, office management and, where necessary, the authorised technical maintainer.
Required or optional: A name and at least one contact method are required because we cannot reply without them. The message and second contact method are optional. The form itself is optional; you may also contact us by telephone or email.

2.3. Valuation enquiry

Data processed: In addition to the data in section 2.2: the property address and floor area provided, and whether the visitor is considering a sale, letting or management. The site does not request a title deed, ownership share or proof of ownership.
Purpose: Understanding the valuation request, making contact and preparing the potential service.
Legal basis: GDPR Article 6(1)(b): steps taken at the data subject's request before entering into a contract. For the security hash, GDPR Article 6(1)(f).
Source: Provided by the visitor. We do not use a free-text address to verify or determine who owns the property.
Recipients and processors: BERNINA Kft. staff dealing with valuations and Railway Corporation as processor. Communications providers used to transmit a reply as described in section 2.2.
Transfer outside the EEA: The safeguards described in section 2.1 apply to Railway's processing in the USA.
Retention: Under the purpose- and legal-claim-based retention rule described in section 2.2.
Access: Staff working on the valuation enquiry, office management and, where necessary, the authorised technical maintainer.
Required or optional: A name and at least one contact method are required. Property details and the intended transaction are optional, but without them we can give only a general response. Use of the form is optional.

2.4. Direct email and telephone contact

Data processed: The correspondent's name, email address or telephone number, the content and time of the message or conversation, and technical delivery data for email. The website does not record telephone calls.
Purpose: Answering the question, arranging an appointment and preparing the requested agency or valuation service.
Legal basis: GDPR Article 6(1)(b) where the contact seeks to prepare a contract; for other general questions, GDPR Article 6(1)(f), the legitimate interest in answering the enquiry.
Source: Directly from the person initiating contact.
Recipients and processors: Relevant BERNINA Kft. staff and the parties' email or telephone providers involved in transmission.
Transfer outside the EEA: Email and telephone routing may depend on the parties' chosen providers; BERNINA Kft. does not promise EEA-only transmission. Details of the relevant provider and safeguard are available on request.
Retention: Correspondence and notes are kept until the matter is resolved and, where necessary, for the retention period of the related contract or legal claim. The general civil-law limitation period is five years.
Access: Staff handling the contact and office management; the authorised technical maintainer in the event of a technical fault.
Required or optional: Contact is voluntary. A usable contact method is necessary for a reply; without one we cannot respond.

2.5. Visitor account and saved properties

Data processed: When the account feature is available: normalised email address, salted scrypt password hash, verification and last-sign-in timestamps, optional display name and three intention flags, saved listings, random session token and expiry, and the one-time code's hash, expiry and failed-attempt count. Neither the password nor the code sent by email is stored in readable form in the database.
Purpose: Creating and verifying the account, sign-in, password reset, retaining saved listings and the visitor's own answers, and protecting the account. Account data does not automatically create an office enquiry or client record.
Legal basis: GDPR Article 6(1)(b): performance of the account service requested by the visitor. For security and rate-limiting data, GDPR Article 6(1)(f): the legitimate interest in protecting accounts and the service.
Source: The visitor's entries and actions, the save action, and security hashes derived from the network connection.
Recipients and processors: Railway Corporation. When a verification or password-reset email is sent, Plus Five Five, Inc. (Resend) and its subprocessors process the email address, message content and delivery data. The office's day-to-day work screens do not display a visitor's saved list; an authorised technical maintainer may access it only where necessary.
Transfer outside the EEA: Yes. Railway's safeguards are described in section 2.1. Resend's primary processing takes place in the USA; it is an active EU-US Data Privacy Framework participant with recertification under review, and its data-processing terms incorporate the EU Standard Contractual Clauses.
Retention: The account and saved list remain until the account is deleted. The visitor can delete the account and every session, code and saved item in one step. A session is usable for 12 hours, or 30 days when Remember me is selected. A one-time code is valid for 10 minutes. Expired session and code rows may technically remain until the next related maintenance action or account deletion, but cannot be used to sign in. Rate-limit hashes older than two hours are deleted on the next account operation.
Access: The account holder; BERNINA Kft.'s authorised technical maintainer where necessary; and the processors above to the extent needed to provide the service.
Required or optional: The account is entirely optional; browsing and enquiries work without it. An email address and password are required for an account. The display name and three intention flags are optional; skipping them has no adverse consequence.

3. Cookies and browser storage

The site uses no audience analytics, advertising or social-media tracking, and loads no third-party embeds. The map, fonts, images and films are served from our own host. ingatlan.com and OpenStreetMap are links only: they receive data only if the visitor opens the link.

The local browser-storage item named hz-mod remembers only the visitor's chosen light or dark appearance. It is not sent to the server and remains until the visitor chooses another mode or clears browser storage. Without a choice, the site follows the device setting.

If visitor accounts are available and somebody signs in, the strictly necessary hz_latogato session cookie contains a random token. It is HTTPOnly, Secure in production, SameSite=Lax and valid across the site. It expires after 12 hours, or 30 days with Remember me. It is deleted on sign-out. Without it, the account and saved list cannot be used, but all public listings remain browseable.

Because storage is used only where necessary for the site, the sign-in requested by the visitor or remembering an expressly selected appearance, there is no consent banner. If non-essential analytics or marketing is added later, it may be enabled only after prior consent with a genuine withdrawal option.

4. Processors and international transfers

The website does not promise EEA-only processing. The current evidenced provider chain is:

Railway Corporation

548 Market St PMB 68956, San Francisco, California 94104, USA

hosting, database, file-storage and network processor

Plus Five Five, Inc. (Resend)

2261 Market Street #5039, San Francisco, California 94114, USA

transactional-email processor, only for verification and password-reset messages when visitor accounts are available

The providers may use subprocessors under their respective data-processing terms. Current lists and copies of transfer safeguards may be requested from the controller. Resend receives visitor data only when the account feature is available and a transactional message must be sent; enquiry forms are not sent to Resend.

5. Your rights

You may request information and access, rectification, erasure, restriction of processing, and portability of data processed by automated means under GDPR Article 6(1)(b). You may object, on grounds relating to your particular situation, to processing based on legitimate interests. This site currently carries out no processing based on consent.

Send your request to the controller using the contact details above. The controller responds without undue delay and generally within one month. Only data necessary to confirm identity may be requested. Rights are subject to statutory conditions and exceptions.

6. Complaint and judicial remedy

If you consider the processing of your personal data unlawful, you may lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work or the alleged infringement. In Hungary this is the National Authority for Data Protection and Freedom of Information. In addition to a complaint, you may seek a judicial remedy under GDPR Article 79 and the Hungarian Privacy Act.

Nemzeti Adatvédelmi és Információszabadság Hatóság
1055 Budapest, Falk Miksa utca 9-11.
Postal address: 1363 Budapest, Pf. 9.
[email protected]
+36 1 391 1400
Customer service and contact
Starting a data-protection case

7. Security, decision-making and data minimisation

The site uses encrypted HTTPS connections, access controls, separate office and visitor sessions, salted scrypt password hashes, short-lived one-time codes and rate limiting. No internet system can promise absolute security; report a suspected incident using the controller's contact address.

The website makes no solely automated decision based on personal data that produces legal or similarly significant effects, and performs no profiling. Public yield estimates are based on property data, not personal profiles. The optional intention flags in an account are not currently used for ranking or personalised recommendations.

Please do not put unnecessary third-party, health, identity-document, financial or other special-category data in a message field. If you provide another person's property address, send only data you are entitled to disclose.

8. Effective date and changes

Effective: 2 September 2026. Version: 1.0. If processing changes materially, this notice will be updated before or when the change takes effect. A previous version is available on request.

GDPR Hungarian Privacy Act Hungarian E-Commerce Act Hungarian Civil Code