Draft version: 30 July 2026. Temporarily noindex pending legal review.
Privacy Policy
1. Who we are and what this Notice covers
This Privacy Policy explains how 3D Flat Finder Zártkörűen Működő Részvénytársaság (short name: 3D Flat Finder Zrt., “3D Flat Finder”, “we”, “us” or “our”) processes personal data in connection with the public marketing website at https://3dflatfinder.com and related website forms, demo requests and partner enquiries.
This Policy does not replace the privacy notice applicable to a specific property developer’s website, an embedded 3D Flat Finder buyer experience, a customer or partner portal, or a contractual SaaS relationship. In an embedded buyer experience, the relevant property developer will normally determine the purpose of lead and buyer-analytics processing as data controller, while 3D Flat Finder may act as its data processor under a separate agreement.
2. Data controller and contact details
Data controller: 3D Flat Finder Zártkörűen Működő Részvénytársaság
Registered office: 2045 Törökbálint, Határ utca 1., Hungary
Company registration number: 13-10-042805
Tax number: 32914294-2-13
Email: vision@3dflatfinder.com
Telephone: +36 70 535 3023
For privacy requests, please use the email address above and write “Privacy request” in the subject line.
3. Personal data we process
| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Website delivery, security and diagnostics | IP address, date and time, requested URL, referrer, browser/device information, security and error logs | Deliver the website, protect it against abuse, diagnose errors, maintain security and availability | Legitimate interests (GDPR Art. 6(1)(f)); necessary technical storage where applicable | Normally up to 30 days, longer only for incidents or claims |
| Contact, demo and partner enquiries | Name, business email, telephone, company, role, country, website, project information, message, communication history and source | Respond to your request, arrange a demo or meeting, assess fit and prepare a possible business relationship | Steps at your request before entering into a contract (Art. 6(1)(b)) and/or legitimate interests in B2B communication (Art. 6(1)(f)) | Normally up to 24 months after the last meaningful interaction if no contract is concluded |
| Business relationship and contracts | Business contact data, correspondence, contractual and billing information | Perform and administer contracts, provide support, comply with accounting and legal duties, manage claims | Contract, legal obligation and legitimate interests (Art. 6(1)(b), (c), (f)) | According to contractual and statutory retention periods |
| Product news and direct marketing | Name, business email, company, consent status, campaign interactions and unsubscribe record | Send product news, research, invitations and relevant commercial communications | Consent (Art. 6(1)(a)); withdrawal available at any time | Until withdrawal or 24 months of inactivity; proof of consent may be retained longer |
| Analytics and performance measurement, if enabled | Pseudonymous identifiers, pages and events, approximate location, browser/device information, campaign source | Understand website usage and campaign performance and improve the website | Consent (Art. 6(1)(a)); tags remain blocked before consent | According to the selected analytics settings and Cookie Policy |
| Marketing tags, if enabled | Pseudonymous browser/device identifiers, page visits, campaign and conversion events | Measure and improve campaigns and, where enabled, create or reach relevant audiences | Consent (Art. 6(1)(a)); tags remain blocked before consent | According to the provider settings and Cookie Policy |
| reCAPTCHA and anti-abuse protection | IP address, browser/device information, interaction and risk signals, reCAPTCHA token | Protect forms and infrastructure against spam, bots, abuse and security threats | Legitimate interests in security (Art. 6(1)(f)); strictly necessary storage where applicable | Token is short-lived; provider-side data and cookies follow Google’s applicable retention rules |
4. Whether providing data is mandatory
You may browse the public website without providing your name or contact details. Technical data required to deliver and secure the website are processed automatically.
Fields marked as mandatory in a contact, demo or partner form are required so that we can understand and respond to your request. If you do not provide them, we may be unable to respond or arrange a requested meeting. Marketing consent is always optional and is not a condition of receiving a response.
5. Where the data comes from
We generally obtain personal data directly from you when you browse the website, submit a form, correspond with us, book a meeting or interact with our business communications. We may also receive business contact details from your employer, a professional partner, a referral source or publicly available professional sources where this is lawful and reasonably expected in a B2B context.
6. Recipients and service providers
We may share personal data only where necessary with carefully selected service providers acting under contract, including website hosting and infrastructure providers, CRM and business-communication providers, email and calendar providers, security and anti-spam providers, and professional advisers.
The contact form currently uses Google reCAPTCHA to protect the website against spam and abuse. Google may process technical and device-related information in connection with that service. Where HubSpot or another CRM is connected to a form, enquiry data may be stored in that system for follow-up and pipeline management.
We may also disclose data where required by law, a court, supervisory authority or competent public body, or where reasonably necessary to establish, exercise or defend legal claims.
7. International transfers
Some service providers may process data outside the European Economic Area. Where this occurs, we rely on an applicable adequacy decision, the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism, together with supplementary safeguards where required.
8. Retention
Website security and diagnostic logs are normally retained for up to 30 days, unless a longer period is required to investigate an incident or protect legal claims.
Contact, demo and partner-enquiry records are normally retained for up to 24 months after the last meaningful interaction where no contract is concluded, unless you object earlier or a longer period is justified by an active opportunity, legal claim or statutory obligation.
Marketing data are retained until you withdraw consent or after 24 months of inactivity, whichever occurs first, unless applicable law permits or requires another period.
Consent and opt-out records may be retained for up to five years to demonstrate compliance. If a contract is concluded, relevant business and accounting records are retained under the applicable contract and statutory retention rules.
9. Your rights
Subject to the conditions of applicable law, you may request access to your personal data, rectification, erasure, restriction of processing, data portability, and information about recipients. You may object at any time to processing based on legitimate interests, including B2B direct marketing. Where processing is based on consent, you may withdraw consent at any time without affecting processing carried out before withdrawal.
To exercise your rights, contact vision@3dflatfinder.com. We may request reasonable information to verify your identity and protect your data.
10. Automated decision-making and profiling
The public marketing website does not make decisions about you based solely on automated processing that produce legal effects or similarly significant effects. Website and CRM systems may be used to organise enquiries, measure campaign performance or support human follow-up, but material commercial decisions are made by people.
11. Security
We use proportionate technical and organisational measures designed to protect personal data against unauthorised access, alteration, loss or disclosure. These measures may include encrypted transport, access controls, logging, malware protection, backups and restricted administrative access. No online system can be guaranteed to be completely secure.
12. Children
The website is intended for business users and adults considering professional services. It is not directed to children under 16, and we do not knowingly request personal data from children through the website.
13. Complaints and supervisory authority
We encourage you to contact us first so that we can address your concern. You also have the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9-11.; postal address: 1363 Budapest, Pf. 9.; email: ugyfelszolgalat@naih.hu; website: https://www.naih.hu.
You may also seek a judicial remedy before the competent court under applicable law.
14. Changes to this Policy
We may update this Policy to reflect legal, technical or business changes. The current version and its effective date will be published on this page. Material changes will be highlighted where reasonably appropriate.
15. Contact
Questions about this Policy or our use of personal data may be sent to vision@3dflatfinder.com or by post to 2045 Törökbálint, Határ utca 1., Hungary.