1Scope of this Policy

This policy covers all data processing activities on the Eco-Office.hu website and related services, including:

2Definitions

Personal data	Any information relating to the data subject (e.g., name, email, phone number)
Data processing	Any operation performed on personal data (collection, storage, use, deletion)
Data processor	Entity that processes personal data on behalf of the data controller
Data subject	The natural person whose data is being processed
Consent	Freely given, specific, informed, and unambiguous indication of the data subject's wishes

3Registration and Account Management

Data processed	Full name, email address, phone number, password (encrypted), billing information
Purpose	User account creation, service provision, digital access
Legal basis	GDPR Art. 6(1)(b) – contract performance
Retention period	Until account deletion; billing data: 8 years

4Booking and Rental

Data processed	Name, email, phone number, booking time, payment details, access ID, time of entries (access log)
Purpose	Desk/office booking, digital access, checking the validity of passes and subscriptions, invoicing, shareable pass management
Legal basis	GDPR Art. 6(1)(b) – contract performance
Retention period	5 years from contract termination; billing data: 8 years; access log: 1 year

During digital access we record which access ID opened the door and when. This is necessary to check the validity of passes and subscriptions and to operate the self-service model.

5Camera Surveillance

A security camera system operates in the common areas of the Coworking Space – entrance, shared workspace, kitchen, corridors – for the protection of property and persons. Signs on site indicate the areas covered.

Where no recording takes place

There are no cameras in the private offices, meeting rooms and studios, and no recordings are made there. We also place no cameras in restrooms or changing rooms, or anywhere that would violate human dignity.

Data processed	Video footage of the common areas (no audio is recorded)
Data subjects	Every person entering the Coworking Space
Purpose	Protection of property, of users and of equipment; prevention and proof of damage and unlawful acts
Legal basis	GDPR Art. 6(1)(f) – legitimate interest of the controller
Retention period	7 days, after which the footage is deleted automatically
Access	Only authorised staff of the controller and competent authorities

For this legitimate-interest processing we have carried out a legitimate interest assessment, weighing the security purpose against the privacy rights of data subjects. The assessment is available on request via the contact details in Section 12.

Footage is kept beyond 7 days only where it serves to prove damage, theft or another unlawful act and proceedings have been started
In case of suspected crime we file a police report and hand the footage over to the authorities
Otherwise we do not disclose footage to third parties, and we do not use it to monitor work performance or the behaviour of users
Data subjects may request access to footage concerning them; the request must be submitted within the retention period

Right to object

As the processing is based on legitimate interest, you may object to it at any time on grounds relating to your particular situation. In that case we stop processing the footage unless there are compelling legitimate grounds that override your interests, or the processing is necessary for the establishment of legal claims.

6Contact and Newsletter

Contact Form

Newsletter

You can unsubscribe from the newsletter at any time by clicking the link at the bottom of the email or by sending a request to ecoofficebudapest@gmail.com.

7Invoicing

Data processed	Name, address, tax number (if applicable), purchase details
Purpose	Issuing invoices in compliance with legal requirements
Legal basis	GDPR Art. 6(1)(c) – legal obligation (Hungarian Act CXXVII of 2007)
Retention period	8 years

8Cookies

The website uses cookies to improve user experience and for statistical purposes.

You can delete or disable cookies in your browser settings at any time. On your first visit, the cookie banner allows you to select which categories to allow.

9Data Transfer and Processors

The Data Controller uses the following data processors:

Firebase (Google)	Hosting, database, authentication – USA (EU-U.S. Data Privacy Framework)
Stripe / SimplePay	Online payment processing – USA / Hungary
Számlázz.hu / Billingo	Invoicing – Hungary
Mailchimp / Brevo	Newsletter delivery – USA / EU (with appropriate safeguards)

Data is transferred to third countries (outside EEA) only with appropriate safeguards (Standard Contractual Clauses, Privacy Framework).

10Data Security

We implement appropriate technical and organizational measures to protect personal data:

11Your Rights

Under GDPR, you have the following rights:

12Legal Remedies

Direct Contact

You can exercise your rights via email (ecoofficebudapest@gmail.com) or postal mail. We will respond to your request within 30 days.

Judicial Remedy

In case of violation of your personal rights, you may seek judicial remedy. The case may be brought before the court of your place of residence.

13Automated Decision-Making

The Data Controller does not use automated decision-making or profiling that would have legal effects on the data subject.

14Policy Amendments

The Data Controller reserves the right to unilaterally amend this policy. Users will be notified of changes on the website. The amended policy takes effect upon publication.

Last updated: October 14, 2026

Strictly necessary	Website operation, session – Legitimate interest – Until session end
Analytical	Visitor statistics – Consent – 2 years
Marketing	Personalized advertising – Consent – 1 year

Data Controller Information