1. Data controller and scope
Controller: LUX HOME BAU Kft. Registered office: 1025 Budapest, Szépvölgyi út 54, Hungary. Company registration number: 01 09 332656. Hungarian tax number: 26320834-2-41. For privacy matters, contact [email protected] or write to our registered office.
This notice covers browsing the website and using its enquiry and careers forms. Processing related to a subsequent construction or employment contract requires separate information appropriate to that relationship.
2. Contact and project enquiries
The form asks for your name, email address, phone number, message and selected service. You may optionally provide a location, related project and attachments. We also record the submission time, reference, language, processing status and acknowledgement of this notice.
We use this information to answer your question, understand the technical requirements and prepare a quotation. For an individual acting on their own behalf, the legal basis is taking steps at their request before entering into a contract (GDPR Article 6(1)(b)). For business representatives and general enquiries, the basis may be our legitimate interest in responding and maintaining business communications (Article 6(1)(f)); you may object to this processing.
Providing information is not a statutory requirement. The form cannot be submitted without the required fields; you may also contact us by phone or email. Please do not send personal information unnecessary for the discussion.
3. Job applications
We process your name, email address, phone number, professional introduction, selected field and any documents you choose to upload to assess your application and contact you. Taking steps at your request before entering into an employment contract is the legal basis under GDPR Article 6(1)(b).
A photograph, place of birth, family status, health information or copy of an identity document is not required for an introduction. Applying does not constitute consent to advertising or indefinite inclusion in a candidate database.
4. Website operation and security
The web server and traffic protection service may process technical data to serve requests and investigate abuse, including IP addresses, request times, requested URLs, response codes and browser details. The purpose is secure website operation, based on the legitimate interests of the controller and visitors in security (GDPR Article 6(1)(f)).
A short-term rate limit protects the form against excessive submissions. In IP-based mode, the application uses a hash of the IP address for this purpose. The limit lasts 10 minutes; expired rate-limit records are removed when the next submission is attempted.
Our forms also use ALTCHA verification hosted on our own server. The browser performs a short computational task, with no image puzzles to solve. Verification uses no tracking cookies and sends no data to an external CAPTCHA provider. Challenges and identifiers used to prevent reuse are valid for 10 minutes; expired identifiers are deleted when a new challenge is requested or during hourly maintenance.
Submitted information and files are stored outside publicly accessible directories. The application does not use advertising profiling, analytics or solely automated decisions with legal effects. The separate cookie notice explains how preferences are stored.
5. Retention
We retain information submitted through the enquiry and careers forms, attachments and notification copies stored by the website for 90 days from receipt. An hourly check deletes expired web records and files, so deletion takes place by the next check after the deadline.
The same 90-day rule applies to email and working copies of unsuccessful enquiries and rejected applications. The staff member handling the enquiry is responsible for deleting those copies. We do not retain applications for future vacancies without separate consent.
If an enquiry leads to a contract, data needed to perform that contract or meet a statutory obligation is processed under the notice for that relationship. This does not automatically extend the 90-day retention of the website inbox copy. For a specific legal claim, we retain only necessary information on a documented legal basis and for as long as needed.
The web server’s own access and error logs rotate daily and retain up to 90 archived files. Rate-limit data is deleted as described in section 4. Restoring a backup does not restart retention: expired web data must be removed before it is used again.
You can request earlier deletion at [email protected]. Where possible, include your submission reference; we assess requests under the conditions described in section 7.
6. Access and service providers
Access is limited to authorised staff handling the enquiry and the technical providers below, to the extent needed for their tasks. Submitted CVs and plans are not published, and we do not sell the data.
Hosting and server infrastructure: Amazon Web Services (AWS). Its European contracting provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. The service stores the website, submitted information and files. Contact: aws.amazon.com/contact-us/.
Email: MediaCenter Hungary Kft., 6000 Kecskemét, Erkel Ferenc utca 5, Hungary; [email protected]. The provider processes incoming and outgoing messages, contact details and attachments to provide email services.
Traffic protection and content delivery: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. The provider processes web traffic, including connection and request data, to serve and protect the website.
The providers’ international infrastructure may involve processing outside the EEA. AWS and Cloudflare processing terms include the European Commission’s Standard Contractual Clauses (SCCs) and relevant adequacy mechanisms where applicable. Details are available through the links below; you can request information and a copy of the safeguards applicable to us at [email protected].
Information and attachments submitted through the forms are included in an email notification for the staff handling the enquiry. Quote requests are sent to [email protected]. Staff can reply directly to the person who submitted the form.
7. Your rights
You may ask whether we process your data, request access and a copy, and ask for inaccurate information to be corrected. Subject to the GDPR conditions, you may request erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation.
If any subsequent processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. The privacy checkbox on the form records acknowledgement of this notice, not general marketing consent.
Send requests to [email protected] or by post. We normally respond within one month. For complex or numerous requests this may be extended by two further months, with reasons provided within the first month. If needed, we request only additional information reasonably necessary to verify identity. Exercising your rights is generally free of charge.
8. Complaints and remedies
You may contact us directly about a privacy concern. Independently, you have the right to complain to a competent data protection supervisory authority and seek a judicial remedy.
In Hungary, the authority is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9–11; postal address: 1363 Budapest, Pf. 9, Hungary; phone: +36 1 391 1400. See its website for the available ways to initiate a procedure.
9. External websites and updates
Maps and related companies are available through links. Their websites have their own privacy notices. This site does not load an embedded Google map; images and fonts are served from its own address.
Changes to this notice are published here with an updated date. We provide appropriate information before introducing a new processing purpose.