This policy explains what personal data we process about you, for which purposes and on which legal bases, who can access it, how long we keep it and what rights you have. It follows Articles 13 and 14 of the General Data Protection Regulation (GDPR).
1. The controller
The controller of your personal data is József Bognár, a freelance advisor who provides Dubai property investment advice to Hungarian investors under the name “Dubaji Ingatlan Stratéga” (“we”, “us” or the “Controller”).
For data protection matters the Controller can be reached by e-mail: [email protected]
Given the nature and scale of the activity we are not required to appoint a data protection officer; you can contact the Controller directly with any data protection question.
2. Scope of this policy
This policy covers the dubajiingatlanstratega.hu website (Hungarian and English versions), the forms on it (contact, e-book request, consultation booking, waitlist, partner application), registered user accounts, and the related e-mail and video call communication.
We process personal data under Regulation (EU) 2016/679 (GDPR) and, where applicable, the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).
We usually receive your data directly from you. If we obtain data from another source (for example through a partner’s referral link, or when a partner forwards your inquiry), we will tell you the source and the categories of data at the latest when we first contact you.
3. Processing activities, purposes and legal bases
Below, for each activity, we describe the purpose, the data processed, the legal basis and the retention period. Without the mandatory fields we cannot provide the service you request; otherwise providing data is voluntary.
Contact and e-book requests
- Purpose: Answering your inquiry, sending the e-book or material you requested, and the related follow-up.
- Data processed: Name, e-mail address, phone number (optional), message, where the form was submitted (for example which page or calculator), language, time of consent, partner referral code if any, the browser identification string (user agent), and an irreversible hash of your IP address. We do not store the IP address itself.
- Legal basis: Your consent (GDPR Art. 6(1)(a)) and steps taken at your request prior to entering into a contract (Art. 6(1)(b)); for technical data used to prevent abuse, our legitimate interest (Art. 6(1)(f)).
- Retention: 24 months after the inquiry is closed, after which the data is anonymised automatically. If you withdraw your consent or ask for erasure earlier, we delete it earlier.
Consultation booking, reminders and online meetings
- Purpose: Booking, confirming, rescheduling and cancelling the consultation, sending reminders (24 hours and 1 hour before), sending a calendar file (ICS) and providing the online video call.
- Data processed: Name, e-mail address, phone number (optional), time zone, language, format and time of the consultation, a unique link for managing the booking, the reason for cancellation if you give one, the video call link.
- Legal basis: Performance of a contract or steps taken at your request prior to a contract (Art. 6(1)(b)); the consent you give when booking is logged.
- Retention: 24 months after the time of the consultation or its cancellation, after which the personal data is anonymised automatically.
Online consultations take place on Jitsi Meet (meet.jit.si). When you join through the link, the service operator processes your connection data (such as IP address, display name, video and audio) to run the call. We do not record calls.
Waitlist
- Purpose: Notifying you when a consultation slot becomes available on the days you prefer.
- Data processed: Name, e-mail address, time zone, language, preferred days, time of consent and of notification.
- Legal basis: Your consent (Art. 6(1)(a)).
- Retention: Up to 24 months, or until you withdraw your consent; the data is then anonymised automatically.
Partner and cooperation applications
- Purpose: Assessing your application and agreeing the terms of cooperation.
- Data processed: The data given in the application form (name, e-mail address, phone number, message), the version and time of acceptance of the terms, and the technical data listed under contact requests.
- Legal basis: Steps prior to a contract (Art. 6(1)(b)) and your consent (Art. 6(1)(a)).
- Retention: 24 months after the application is closed; if a cooperation is established, for the term of the contractual relationship and until related claims become time-barred.
Direct contact by e-mail or WhatsApp
- Purpose: If you write to us directly by e-mail or WhatsApp, we use the conversation to answer your question.
- Data processed: Name, e-mail address or phone number, content of the messages.
- Legal basis: Your consent or steps prior to a contract (Art. 6(1)(a) and (b)).
- Retention: 24 months after the inquiry is closed, unless a client relationship is established (see below).
Client relationship and advisory work
- Purpose: If we start working together after your inquiry or consultation, we keep a client record to follow the advice, project offers and communication.
- Data processed: Name, e-mail address, phone number, the budget and interests you share with us (for example projects), notes and tasks about our communication, offers sent to you, and whether and when an offer was opened.
- Legal basis: Performance of a contract or steps prior to a contract (Art. 6(1)(b)), and our legitimate interest in keeping client records (Art. 6(1)(f)).
- Retention: For the duration of the client relationship; after it ends, or on request, the data is deleted or anonymised unless the law (for example accounting rules) requires longer retention.
User account
- Purpose: Registration, sign-in, account security (e-mail verification, password reset, optional two-factor authentication) and the services tied to the account.
- Data processed: E-mail address, name, phone number (optional), language, a one-way hash of the password, the encrypted two-factor authentication key, time of e-mail verification and of last sign-in.
- Legal basis: Performance of a contract (terms of use) (Art. 6(1)(b)).
- Retention: For as long as the account exists. You can request deletion of the account and your data on the “My data” page or by e-mail.
System e-mails
- Purpose: Delivering confirmations, reminders, the requested e-book and account notifications.
- Data processed: E-mail address, name, message content (and a calendar file where needed).
- Legal basis: The legal basis of the underlying processing (Art. 6(1)(a) or (b)).
- Retention: Delivery logs are kept by the e-mail provider under its own retention period; local fallback e-mail files are deleted automatically after 30 days.
Consent records
- Purpose: Proving when, for which purpose and on which form you gave your consent (accountability).
- Data processed: An irreversible hash of the e-mail address, the purpose of the consent, the version of the accepted terms, the name of the form, the time, and a hash of the IP address.
- Legal basis: Compliance with a legal obligation (Art. 6(1)(c), under GDPR Art. 5(2) and Art. 7(1)).
- Retention: For as long as the consent-based processing lasts, and afterwards until any related claims can be enforced.
Security, abuse prevention and access log
- Purpose: Protecting the system and the forms (rate limiting, Cloudflare Turnstile spam filtering), detecting unauthorised access and keeping administrative actions traceable.
- Data processed: User ID, type, subject and time of the action; for rate limiting the IP address is used only temporarily, in memory. On an erasure request the e-mail address in the log is replaced with a pseudonym.
- Legal basis: Legitimate interest (Art. 6(1)(f)).
- Retention: The access log is kept for 36 months.
First-party usage statistics
- Purpose: Aggregate analysis and improvement of how the site is used (for example which pages and tools visitors use).
- Data processed: Page viewed and event, time, a random identifier for the browser session (deleted when the browser is closed), browser type, a salted irreversible hash of the IP address; for signed-in users, the user ID. This data is not shared with third parties.
- Legal basis: Legitimate interest (Art. 6(1)(f)).
- Retention: 13 months, then deleted automatically.
Google Analytics 4 and Meta Pixel
- Purpose: Usage statistics and measuring the effectiveness of our advertising.
- Data processed: Cookie identifiers, pages viewed, device and browser data, IP address (processed by the providers).
- Legal basis: Only your consent (Art. 6(1)(a)), given in the cookie banner; without consent these tools are not loaded.
- Retention: According to the providers’ settings (see the Cookie Policy); you can withdraw your consent at any time.
4. Recipients and processors
We do not sell your data. The following providers can access it as processors (or, where indicated, as independent controllers), only for the stated purpose:
- Cloudflare, Inc. (USA) – website delivery, content delivery network (CDN), security filtering and Turnstile spam protection; it processes your IP address and browser data for this.
- Hosting and server provider – running the application and the database.
- Resend (USA) – delivery of system e-mails; it processes the e-mail address, name and message content.
- Sentry (Functional Software, Inc., USA) – error monitoring; configured not to send personal data (IP address, e-mail address, cookies, form content), only technical error information.
- Google Ireland Limited / Google LLC – loading Google Fonts (your browser sends your IP address to Google’s servers for this) and, with your consent, Google Analytics 4.
- Meta Platforms Ireland Limited – the Meta Pixel with your consent; for messages sent on WhatsApp, the WhatsApp provider acts as an independent controller.
- Jitsi Meet (meet.jit.si, 8x8, Inc., USA) – video calls for online consultations.
- Property developers, real estate agencies and other professionals (for example financing or visa partners) – only at your explicit request or with your consent, limited to the data needed for the requested matter.
- Authorities and courts – only where required by law.
5. International transfers
The Controller works from Dubai (United Arab Emirates), so your data is also accessed and processed from the UAE. The European Commission has not adopted an adequacy decision for the UAE; the transfer is necessary to provide the service you request (advice, consultation) (GDPR Art. 49(1)(b)), and the data is protected by the same technical and organisational measures.
Several of our providers (Cloudflare, Resend, Sentry, Google, Meta, 8x8) also process data in the United States. Such transfers rely on the provider’s certification under the EU–US Data Privacy Framework where available, and otherwise on the Standard Contractual Clauses adopted by the European Commission (GDPR Art. 46(2)(c)) together with supplementary safeguards.
You can request more information on these safeguards, or a copy of them, at: [email protected]
6. Retention periods at a glance
We keep your data only as long as needed for the purpose. When the retention period ends, a daily automated process anonymises or deletes it:
- Contact, e-book and partner application data: 24 months after the inquiry is closed.
- Consultation bookings: 24 months after the time of the consultation or its cancellation.
- Waitlist: up to 24 months, or until consent is withdrawn.
- User account: until the account is deleted.
- First-party usage statistics: 13 months.
- Security and access log: 36 months.
- Cookie preference: 12 months; partner referral cookie: 90 days.
7. Your rights
Under the GDPR you have the following rights:
- Access (Art. 15): you can ask for information about, and a copy of, the data we hold about you.
- Rectification (Art. 16): you can ask us to correct inaccurate data or complete incomplete data.
- Erasure, “right to be forgotten” (Art. 17): you can ask us to delete your data if it is no longer needed or you have withdrawn your consent.
- Restriction of processing (Art. 18): for example while you contest the accuracy of the data.
- Data portability (Art. 20): you can receive the data processed on the basis of consent or contract in a structured, machine-readable format (JSON).
- Objection (Art. 21): you can object at any time to processing based on legitimate interest.
- Withdrawal of consent (Art. 7(3)): at any time, without giving reasons; this does not affect the lawfulness of processing before the withdrawal. You can also withdraw cookie consent by clearing the cookies and site data stored in your browser.
- We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22).
How to exercise your rights
- As a registered user, on the “My data” page of your account you can download your data in JSON format and request deletion of your account and data: Open My data
- In every other case – for example if you are not registered and only filled in a form or booked a consultation – e-mail us at: [email protected]
- We reply without undue delay and within one month at the latest; where justified this can be extended by two further months, in which case we will let you know. Handling your request is free of charge.
- To prevent abuse we may ask you to confirm your identity; usually this means sending the request from the e-mail address the data belongs to.
8. Remedies and complaints
If you believe that the processing of your data breaches the law, please contact us first so that we can fix the problem quickly. You also have the following options:
- A complaint to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9–11; postal address: 1363 Budapest, Pf. 9; e-mail: [email protected]; website: www.naih.hu.
- You can also lodge a complaint with the supervisory authority of the EU Member State where you live or work, or go to court; in Hungary you may also bring the case before the regional court of your place of residence.
- In the United Arab Emirates the Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) may also apply; we accept requests to exercise the rights it grants at the same e-mail address, and you may complain to the UAE Data Office.
9. Cookies in brief
Our website uses the following cookies and browser storage entries:
- cookies_accepted – remembers your cookie choice (12 months, strictly necessary).
- dis_ref – if you arrive through a partner’s referral link (?ref=), stores the partner code so we know who referred you (90 days).
- hub:analytics:sid – first-party statistics session identifier in the browser’s session storage (deleted when the browser is closed).
- Google Analytics 4 and Meta Pixel cookies – only after your consent.
Full details: Cookie Policy
10. Data security
We protect your data with appropriate technical and organisational measures: encrypted (HTTPS) connections, IP addresses stored only as irreversible hashes, one-way hashed passwords, encrypted two-factor authentication keys, role-based access control and logging, and automatic anonymisation when the retention period ends.
11. Children
Our services are not directed at children under 16 and we do not knowingly collect their data. If we become aware of such data, we delete it without delay.
12. Changes to this policy
We update this policy when the law or our services change; the current version is always available on this page with its update date. We may also inform data subjects of material changes by e-mail.
For any data protection question, write to us at: [email protected]