Privacy Notice

1.The data controller and its contact details

The controller of your personal data is the developer of the MARA Residence project (the "Controller"):

• Company name: Faedra III. Ingatlanfejlesztő Alap
• Registered office: 1132 Budapest, Váci út 22-24., 5. emelet
• MNB register number (Magyar Nemzeti Bank register): 1222-67
• Tax number: 19396697-2-41
• E-mail: faedrahomes@oc.hu

• Company name: Faedra Alapkezelő Zártkörűen Működő Részvénytársaság
• Registered office: 1132 Budapest, Váci út 22-24., 5. emelet
• Company registration number: 01-10-141781
• Tax number: 27780798-2-41
• Represented by: Nikolett Majorosi, CEO

The Controller is not obliged to appoint a data protection officer (DPO) under Article 37 GDPR and has not appointed one. Requests concerning data protection may be addressed to the contact details above; the Controller will respond without undue delay and in any event within one month of receipt.

2.Scope of this notice, applicable law

This notice applies to the processing connected with the operation of the Website and with the inquiry and price-request form available on the Website. Such processing is governed by the GDPR and the Privacy Act, and, as regards electronic communications data (cookies and similar technologies), also by Act CVIII of 2001 on Electronic Commerce and Act C of 2003 on Electronic Communications.

The source of personal data is always the Data Subject; through the Website, the Controller processes only the data you provide and data generated technically while using the Website. The Controller does not request or process special categories of data, and the Website is not directed at persons under the age of 16.

3.Handling inquiries and price requests

Through the Website's inquiry, or price-request, form you may contact us and request an offer for the apartments in the development. In doing so we process the following data:

• full name, e-mail address, phone number (mandatory fields);
• the message you write (up to 500 characters, optional);
• whether you requested further information about additional apartments or about the launch of further projects (see Section 4);
• the fact of accepting the privacy declaration, the Website's language, and the time of submission;
• the marketing source data of your visit: the landing page, referrer page and campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) of your first and most recent visit, and, where recognisable, the name of the property portal you arrived from (ingatlan.com, alberlet.hu, otthonterkep.hu, koltozz.hu); and, only with your statistics consent, the session identifier.

The purpose of the processing is to receive and answer your inquiry or price request, to provide an offer, and to maintain contact prior to entering into a contract. Its legal basis is Article 6(1)(b) GDPR: the processing is necessary for taking steps prior to entering into a contract at your request. Submitting the form is an inquiry made on your own initiative; answering it is not possible without the data entered in the mandatory fields. Bot protection (Cloudflare Turnstile) is described in Section 6.

The marketing source data are not asked on the form: they are stored during your visit in a first-party entry placed in your browser's local storage (mara-attribution-v1), and are read only at the moment the form is submitted, then transmitted together with the inquiry. The purpose of this processing is to allow a submitted inquiry to be linked to the correct marketing channel, in particular to the advertising portal or campaign; its legal basis is the Controller's legitimate interest under Article 6(1)(f) GDPR: measuring the effectiveness of its marketing activity and planning its sales channels. Under the balancing test, this data is limited to the circumstances of your arrival at the Website, the Controller does not learn your browsing history outside the Website, does not build a profile of you from it and does not make automated decisions, and you may object to this processing at any time (see Section 11). You may delete the entry at any time in your browser settings; the Cookie Notice provides detailed information about the entries stored on the Website.

If you have consented to statistics processing in the cookie banner, the session identifier created in your browser's session storage (mara-session-v1) is also transmitted together with your inquiry, allowing the inquiry to be linked to the statistical data of your visit. Its legal basis is your consent (Article 6(1)(a) GDPR), which you may withdraw at any time without giving a reason; in the absence of consent, no such identifier is created or transmitted.

Providing your data is voluntary, but completing the mandatory fields is a condition for answering your inquiry or price request. Retention period: if the inquiry does not result in a contract, the data are deleted 12 months after the last substantive contact. If a contract is concluded, the further processing of your data is governed by separate information relating to the contractual relationship. The Controller may keep verifiable records of the fact that the privacy declaration was made, on the basis of the accountability principle (Article 5(2) GDPR), until the end of the general civil-law limitation period (5 years).

4.Requesting further information

The inquiry, or price-request, form has two independently selectable checkboxes through which you may expressly request that the Controller inform you by e-mail about further MARA Residence apartments becoming available, or about the launch of further apartment projects. For this purpose we process your name and e-mail address.

The legal basis of this processing is your consent (Article 6(1)(a) GDPR, and Section 6 of Act XLVIII of 2008 on the Basic Conditions and Certain Restrictions of Commercial Advertising Activity). Giving consent is voluntary, is not a condition for having your inquiry or price request answered, and may be withdrawn at any time without giving a reason by sending a message to faedrahomes@oc.hu. Withdrawal does not affect the lawfulness of processing before the withdrawal.

Retention period: until consent is withdrawn, or otherwise until the general retention period described in Section 3.

5.Operation of the Website, logging

While the Website is displayed, the hosting service (Vercel) may record technical log data: IP address, the address of the page requested, browser and operating system type, and the time of the visit.

The purpose of this processing is the secure operation of the Website and the detection and prevention of abuse; its legal basis is the Controller's legitimate interest in this (Article 6(1)(f) GDPR). Log data is retained for a short period, typically up to 30 days depending on the provider's settings, and is used only for troubleshooting or incident investigation.

6.Web analytics and bot protection

Umami (cookieless web analytics): to measure the Website's traffic, the Controller uses a cookieless statistics solution called Umami. Umami's tracking code places no cookie or other data on your device, and reads no previously stored data from it: visitors are distinguished server-side, by an identifier derived from the IP address, the browser identifier (user agent) and the Website's identifier. Processing of the IP address in this context is transient and serves solely to generate this identifier.

Since no storage on, or reading from, your device takes place, the consent requirement under Section 155(4) of Act C of 2003 on Electronic Communications does not apply to this measurement: Umami runs independently of, and even before, any decision made in the cookie banner. The legal basis for the transient processing of the IP address is the Controller's legitimate interest (Article 6(1)(f) GDPR): understanding use of the Website and developing the service. Under the balancing test, the measurement is limited to producing aggregate traffic statistics, no individual visitor profile is created, visitors are not tracked across devices or websites, and the Controller does not use the measurement data for advertising purposes. You may object to this processing at any time (see Section 11).

For statistical measurement, only if you have consented to statistics processing in the cookie banner, the Website creates a randomly generated session identifier (mara-session-v1) in your browser's session storage (sessionStorage), which links the visitor's within-page interactions together. Its legal basis is your consent (Article 6(1)(a) GDPR); in the absence of consent, the Website does not create or store such an identifier. When the form is submitted, this identifier is transmitted as described in Section 3.

Cloudflare Turnstile (bot protection): to protect the inquiry and price-request form against automated abuse by bots, the Controller uses the Cloudflare Turnstile service. Turnstile is a cookieless solution: it places no cookie on your device, and processes technical characteristics (for example IP address, browser environment signals) to make the distinction. The Controller's server verifies the result of the check when the form is submitted, and does not transmit the inquiry where the check clearly fails. The data is not used for advertising purposes. The legal basis of this processing is the Controller's legitimate interest in the secure operation of the Website and the form (Article 6(1)(f) GDPR).

The Controller will inform you of any change in the scope or operation of the services described in this Section by updating this notice or the Cookie Notice.

7.Marketing pixels: Meta and TikTok

To measure the effectiveness of our advertising, and only with your express consent, the Website loads the "Meta Pixel" tracking code of Meta Platforms Ireland Limited and the "TikTok Pixel" tracking code of TikTok Information Technologies UK Limited. These tracking codes are not loaded until you consent to the marketing category in the cookie banner; in the absence of consent, the Website transmits no data to these providers.

The tracking codes process the fact that you viewed the Website, together with the associated identifiers recorded in cookies placed by the providers; their purpose is to measure the effectiveness of our advertising and to tailor our future advertisements based on your earlier visit (remarketing). Details of the individual cookies, their duration and the providers' own processing are set out in the Cookie Notice.

The legal basis of this processing is your consent (Article 6(1)(a) GDPR), which you may give using the "Marketing" toggle in the cookie settings, and which you may withdraw at any time without giving a reason by clicking the "Cookie settings" link in the Website's footer. Please note, for technical reasons, that withdrawal does not remove tracking codes already loaded on the page currently open in the Website: withdrawal takes effect from the next page load, that is, from your next visit to, or refresh of, the Website.

Meta and TikTok process the data they handle as independent controllers in their own right, under their own privacy policies; see the Meta Privacy Policy and the TikTok Privacy Policy for details.

8.Recipients, processors

The data submitted via the inquiry and price-request form are accessible to the Controller's sales staff and its appointed sales partner (Otthon Centum Solutions Kft., registered office: 1023 Budapest, Lajos utca 28-32., company registration number: 01-09-728100), solely for the purpose of handling your inquiry or price request.

The Controller uses the following processors:

The processors process data solely on the Controller's instructions, under a data processing agreement pursuant to Article 28 GDPR; in operating the marketing pixels, however, Meta and TikTok also process certain data as independent controllers in their own right (see Section 7). The Controller may disclose data to a competent authority upon an official request, pursuant to its statutory obligation.

9.Transfer of data to third countries

Some of the providers listed in Section 8 (Mailgun, Vercel, Cloudflare, Meta) may process data outside the European Economic Area, primarily in the United States. Such transfers are safeguarded by the standard contractual clauses adopted by the European Commission (SCCs, Article 46(2)(c) GDPR) and, where the provider is a certified participant, by the adequacy decision for the EU-U.S. Data Privacy Framework (Article 45 GDPR).

For a copy of, or further information about, these safeguards, please contact the Controller at faedrahomes@oc.hu.

10.Data security

The Controller protects personal data with technical and organisational measures appropriate to the level of risk (Article 32 GDPR): traffic to and from the Website and the form is encrypted (TLS/HTTPS), only authorised persons bound by confidentiality have access to the data, and processing is limited to the minimum necessary for the purpose.

11.Rights of data subjects

In connection with the processing of your personal data, you have the following rights:

• access (Article 15 GDPR): you may request information on which of your data we process and for what purpose, and request a copy of it;
• rectification (Article 16 GDPR): you may request the correction of inaccurate data and the completion of incomplete data;
• erasure ("the right to be forgotten", Article 17 GDPR): you may request the deletion of your data where it is no longer needed, you have withdrawn your consent, or the processing is unlawful;
• restriction of processing (Article 18 GDPR);
• data portability (Article 20 GDPR): you may receive data processed on the basis of consent or contract, by automated means, in a structured, commonly used, machine-readable format;
• objection (Article 21 GDPR): you may object at any time, on grounds relating to your particular situation, to processing based on legitimate interest; in that case we will only continue processing the data if compelling legitimate grounds justify it;
• withdrawal of consent (Article 7(3) GDPR): where processing is based on consent, you may withdraw your consent at any time without giving a reason, which does not affect the lawfulness of processing before the withdrawal.

You may submit your request at faedrahomes@oc.hu or at the contact details in Section 1. The Controller will fulfil the request without undue delay and in any event within one month; this period may be extended by a further two months where necessary, taking into account the complexity of the request, and you will be informed of this. Exercising these rights is, as a general rule, free of charge.

12.Remedies

If you consider that the processing of your personal data infringes the GDPR or the Privacy Act, please contact the Controller first at the contact details above; we will try to resolve your complaint as soon as possible. You are also entitled to lodge a complaint with the supervisory authority:

• National Authority for Data Protection and Freedom of Information (NAIH)
• Registered office: 1055 Budapest, Falk Miksa utca 9-11., Hungary
• Postal address: 1363 Budapest, Pf. 9., Hungary
• Phone: +36 (1) 391-1400
• E-mail: ugyfelszolgalat@naih.hu
• Website: www.naih.hu

You may also bring court proceedings (Article 79 GDPR, Section 23 of the Privacy Act): the case falls within the jurisdiction of the regional court (törvényszék), and, at your choice, may also be brought before the regional court of your place of residence or stay.

13.Automated decision-making, profiling

In connection with the Website, the Controller does not carry out decision-making based solely on automated processing that produces legal effects concerning the Data Subject under Article 22 GDPR, and does not carry out profiling.

14.Cookies and similar technologies

The Cookie Notice contains detailed information about the cookies used on the Website, their categories, duration and how to change your consent. Non-essential cookies and entries are placed only with your prior consent.

15.Amendments to this notice

Version 1.0 of this notice is effective from 3 August 2026 and documents the Website's actual processing activities: the inquiry and price-request form, Cloudflare Turnstile bot protection, cookieless Umami web analytics, the statistics-purpose session identifier, the entry used for source attribution, and the consent-based Meta and TikTok marketing pixels. The Controller may unilaterally amend this notice, in particular where the scope of processing changes or the law changes; the version in force at any given time is available on this page, and the version number and update date indicate that an amendment has been made. The Controller will inform you of material amendments in a clearly visible manner on the Website.

A downloadable version of this notice is also available in PDF format.