Privacy Notice

1.The data controller and its contact details

The controller of your personal data is the developer of the NOVA CITY Residence project (the "Controller"):

• Company name: Faedra VI. Ingatlanfejlesztő Részalap
• Registered office: 1132 Budapest, Váci út 22-24., 5. emelet
• MNB register number (Magyar Nemzeti Bank register): 1222-86-3
• Tax number: 19435747-2-41
• E-mail: faedrahomes@oc.hu

• Company name: Faedra Alapkezelő Zártkörűen Működő Részvénytársaság
• Registered office: 1132 Budapest, Váci út 22-24., 5. emelet
• Company registration number: 01-10-141781
• Tax number: 27780798-2-41
• Represented by: Nikolett Majorosi, CEO

The Controller is not obliged to appoint a data protection officer (DPO) under Article 37 GDPR and has not appointed one. Requests concerning data protection may be addressed to the contact details above; the Controller will respond without undue delay and in any event within one month of receipt.

2.Scope of this notice, applicable law

This notice covers the processing operations connected with the operation of the Website and the inquiry form available on it. The processing is governed by the GDPR and the Hungarian Privacy Act; with respect to cookies, it is also governed by Act CVIII of 2001 on Electronic Commerce and Act C of 2003 on Electronic Communications.

The source of the personal data is in every case the Data Subject: the Controller only processes data you provide through the Website and data generated technically in the course of its use. The Controller does not request or process special categories of data, and the Website is not directed at persons under the age of 16.

3.Handling inquiries: the inquiry form

Through the inquiry form on the Website you may request an offer or information about the apartments of the development. In doing so we process the following data:

• full name, phone number, e-mail address (mandatory fields);
• the residential project(s) you are interested in;
• the apartment size (number of rooms) you are looking for;
• your message (up to 500 characters, optional);
• your answer to "where did you hear about us", including the free-text detail given for the "other" option;
• whether you opted in to the newsletter;
• the fact of your acceptance of this privacy notice and the time of submission.

The purpose of the processing is receiving and answering your inquiry, providing an offer, arranging appointments and pre-contract communication. Its legal basis is Article 6(1)(b) GDPR: the processing is necessary in order to take steps at the request of the Data Subject prior to entering into a contract. Submitting the form is a request for an offer made at your own initiative, which cannot be answered without the data provided.

The "where did you hear about us" field is processed on the basis of the Controller's legitimate interest (Article 6(1)(f) GDPR) in measuring the effectiveness of its marketing activity and planning its sales channels. Under the balancing test, this data is neutral to the Data Subject, is limited to a single answer freely chosen by you, is evaluated in aggregate form only, involves no profiling, and you may object to this processing at any time (see Section 10).

Providing your data is voluntary; however, completing the mandatory fields is a precondition of answering your inquiry. Retention: if no contract results from the inquiry, the data are erased 12 months after the last substantive contact. If a contract is concluded, further processing is governed by the separate notice applicable to the contractual relationship. The fact of your privacy declaration may be retained in a verifiable form until the end of the general civil-law limitation period (5 years), based on the principle of accountability (Article 5(2) GDPR).

4.Newsletter and project updates

If you expressly request it by ticking the corresponding checkbox on the form, the Controller will send you newsletters and updates about the development by e-mail. For this purpose we process your name and e-mail address.

The legal basis of this processing is your consent (Article 6(1)(a) GDPR and Section 6 of Act XLVIII of 2008 on Commercial Advertising). Giving consent is voluntary, is not a condition of answering your inquiry, and may be withdrawn at any time without giving reasons, via the unsubscribe option included in every newsletter or by writing to faedrahomes@oc.hu. Withdrawal does not affect the lawfulness of processing before the withdrawal.

Retention: until consent is withdrawn. Upon unsubscribing, your data are deleted from the newsletter database without delay.

5.Operating the Website, server logs

When serving the Website, the hosting and content-delivery infrastructure (Vercel) may record technical log data: IP address, the address of the page requested, browser and operating-system type, and the time of the visit.

The purpose of this processing is the secure and reliable operation of the Website and the detection and prevention of abuse; its legal basis is the Controller's legitimate interest to this end (Article 6(1)(f) GDPR). Log data are stored for a short period, typically no more than 30 days depending on the provider's settings, and are used solely for error and incident investigation.

6.Planned processing: web analytics and bot protection

Google Analytics 4 (web analytics): the Controller plans to introduce Google Analytics 4 to measure Website traffic. Measurement cookies are set only if you have expressly consented via the Website's cookie banner (Article 6(1)(a) GDPR). Consent may be withdrawn at any time by changing your cookie settings; see the Cookie Notice for details.

Cloudflare Turnstile (bot protection): to protect the inquiry form against automated abuse, the Controller plans to introduce Cloudflare Turnstile. Turnstile processes technical signals (such as IP address and browser-environment characteristics) to distinguish humans from bots; the data are not used for advertising. The legal basis is the Controller's legitimate interest in the secure operation of the Website and the form (Article 6(1)(f) GDPR).

The Controller will announce the actual introduction and details of these services by updating this notice and the Cookie Notice.

7.Recipients, data processors

The data submitted via the inquiry form are accessible to the Controller's sales staff and its appointed sales partner (Otthon Centum Solutions Kft., registered office: 1023 Budapest, Lajos utca 28-32., company registration number: 01-09-728100), solely for the purpose of handling your inquiry. The form data may also be forwarded to the Controller's customer-relationship-management (CRM) system ([CRM PROVIDER NAME]).

The Controller uses the following data processors:

Processors act solely on the Controller's instructions, under data-processing agreements pursuant to Article 28 GDPR. The Controller may disclose data to competent authorities only where required by law.

8.Transfers to third countries

Certain providers listed in Section 7 (Mailgun, Vercel, Cloudflare, Google) may process data outside the European Economic Area, primarily in the United States. Such transfers are safeguarded by the standard contractual clauses adopted by the European Commission (SCCs, Article 46(2)(c) GDPR) and, where the provider is a certified participant, by the adequacy decision for the EU–U.S. Data Privacy Framework (Article 45 GDPR).

A copy of, or reference to, the applicable safeguards is available on request at faedrahomes@oc.hu.

9.Data security

The Controller protects personal data with technical and organisational measures appropriate to the risk (Article 32 GDPR): traffic of the Website and the form is encrypted (TLS/HTTPS), the data are accessible only to authorised persons bound by confidentiality, processing is limited to the minimum necessary for the purpose, and the Website does not store the form data in a database of its own.

10.Your rights

In connection with the processing of your personal data you have the following rights:

• access (Article 15 GDPR): you may request information on which of your data we process and for what purpose, and request a copy;
• rectification (Article 16 GDPR): you may request the correction of inaccurate data and the completion of incomplete data;
• erasure ("right to be forgotten", Article 17 GDPR): you may request erasure where the data are no longer needed, you have withdrawn your consent, or the processing is unlawful;
• restriction of processing (Article 18 GDPR);
• data portability (Article 20 GDPR): you may receive the data processed by automated means on the basis of consent or contract in a structured, commonly used, machine-readable format;
• objection (Article 21 GDPR): on grounds relating to your particular situation you may object at any time to processing based on legitimate interest; we will then only continue if compelling legitimate grounds so require;
• withdrawal of consent (Article 7(3) GDPR): where processing is based on consent, you may withdraw it at any time without giving reasons, without affecting the lawfulness of processing before the withdrawal.

Requests may be submitted at faedrahomes@oc.hu or via the contact details in Section 1. The Controller will comply without undue delay and at the latest within one month; this period may be extended by up to two further months where necessary in view of the complexity of the request, of which you will be informed. Exercising your rights is, as a rule, free of charge.

11.Remedies

If you consider that the processing of your personal data infringes the GDPR or the Hungarian Privacy Act, we ask that you first contact the Controller at the details above. We will seek to remedy your complaint as soon as possible. You are also entitled to lodge a complaint with the supervisory authority:

• Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH)
• Address: Falk Miksa utca 9–11., 1055 Budapest, Hungary
• Postal address: 1363 Budapest, Pf. 9., Hungary
• Phone: +36 (1) 391-1400
• E-mail: ugyfelszolgalat@naih.hu
• Website: www.naih.hu

You may also bring the matter before a court (Article 79 GDPR, Section 23 of the Hungarian Privacy Act); the action falls within the competence of the regional courts (törvényszék) and may, at your choice, also be brought before the regional court of your place of residence or stay.

12.Automated decision-making, profiling

In connection with the Website, the Controller does not carry out decision-making based solely on automated processing producing legal effects within the meaning of Article 22 GDPR, and does not engage in profiling.

13.Cookies and similar technologies

Detailed information on the cookies used on the Website, including their categories, lifetimes and how to change your consent, is provided in the Cookie Notice. Non-essential cookies are only set with your prior consent.

14.Amendments to this notice

Version 1.0 of this notice is effective from 19 July 2026. The Controller may amend the notice unilaterally, in particular upon the introduction of the planned processing operations or changes in law; the version currently in force is always available on this page, with amendments indicated by the version number and the date of the update. Material changes will be announced conspicuously on the Website.