Privacy Notice

This Privacy Notice explains in clear language how personal data are processed when using the THGO.hu condominium management web application. Information intended only as an editing instruction must not be published as a substantive privacy commitment.

Deleting a user account does not delete condominiums previously uploaded, created or managed by the user or their condominium-management data. THGO.HU does not retain the deleted account email address as a readable blocklist entry; a one-way SHA-256 technical hash may be retained solely to prevent re-registration with the same email address. The hash is not used for marketing or other purposes.

Data controller: BI88 Kft. Registered address: 4029 Debrecen, Munkácsy Mihály utca 7, ground floor, unit 1, Hungary Tax number: 23321692-1-09 Email: www.thgo.hu@gmail.com Telephone: +36 30 353 2918 Website: https://thgo.hu Where a condominium association, property manager or other organisation uses the System for its own purposes, that organisation may act as an independent controller or in another data-protection role, depending on the circumstances.

thgo.hu domain provider: Company: Netmask Interactive Kft. Registered office: 1131 Budapest, Nővér u. 110, Hungary Tax number: 23134339-2-41 EU VAT number: HU23134339 Company registration number: 01-09-954570 Account-holding bank: CIB Bank Bank account: 10700347-66924779-51200002 Customer service (weekdays 9:00–16:00): +36 1 646 4921 Customer service email: ugyfelszolgalat@netmask.hu General email: info@netmask.hu Hosting provider: Main operating company (billing and legal information): Hostinger International Ltd. Company registration number: HE 301365 (Cyprus) EU VAT number: CY10301365E Registered office/postal address: 61 Lordou Vironos Street, Lumiel Building, 4th Floor, 6023 Larnaca, Cyprus HOSTINGER operations, UAB Address: Švitrigailos str. 34, Vilnius 03230, Lithuania Telephone: +370 645 03378 Email: domains@hostinger.com Website: www.hostinger.com (Hungarian interface: hostinger.hu) Privacy enquiries: gdpr@hostinger.com Customer support: 24/7 live chat and ticket system via the hPanel account.

Depending on the service used and the user’s permissions, the System may process in particular: names; email addresses; telephone numbers; user identifiers and access rights; building, apartment and unit information; ownership, tenancy or occupancy status; ownership shares; common charges, payments and account balances; utility meters and consumption; details appearing in bank transactions; personal data contained in uploaded documents; messages, workflows and electronic voting data; login, security and log information, including IP addresses, timestamps, browser and device information.

Processing may serve in particular to: create and secure user accounts; verify email addresses; maintain records of condominium associations, units, owners, residents and managers; administer access rights; process common charges and utility data; support accounting, banking and petty-cash operations; generate statements and documents; provide resident communications and notices; organise online votes; administer subscriptions and invoicing; prevent misuse, troubleshoot and maintain security logs; establish, exercise or defend legal claims and comply with legal obligations.

Depending on the processing activity, the legal basis may be: performance of a contract or steps taken prior to entering into a contract; compliance with a legal obligation; legitimate interests of the controller or a third party; or consent where the activity relies on consent. The controller must determine and disclose the legal basis applicable to each specific processing purpose in light of actual operations and applicable law.

The email address provided during registration may be used to identify and activate the account, send security notices and communicate with the user. Access to the System may require a verified email address, and access may be restricted until the verification link has been used.

For condominium administration, information about condominium associations, apartments, individual units, owners, residents, tenants and other authorised occupants may be entered in the System. The user who uploads or enters information is responsible for having a lawful basis and appropriate authority to process it, and for limiting the information to what is necessary.

The System may process bank transaction files, incoming payments, common-charge assessments, outstanding debts, overpayments, petty-cash records and other financial information. Card or other online payments may be processed by an external payment service provider. THGO.hu does not store payment-card details where, under the technical payment arrangement, these are entered exclusively into the payment service provider’s system.

Users may upload documents, send messages, manage workflows and participate in online voting according to their permissions. Users uploading information must ensure that personal data included in a document or message are processed lawfully and that no unnecessary or unauthorised personal data are included.

THGO.hu allows Users to connect their own Google account and Google Calendar to the System. The connection is created only after the User expressly consents through Google OAuth 2.0 authorisation. Categories of Google data accessed: the email address associated with the Google account; the permissions necessary to manage Google Calendar events; and OAuth access and refresh tokens supplied by Google. Calendar permissions may technically allow events to be created, viewed, modified and deleted. Purpose: THGO.hu uses Calendar access only to synchronise condominium-related events and deadlines authorised by the User, such as general meetings, maintenance appointments, workflow deadlines and other events concerning the User’s condominium. Google user data are not used for advertising, profiling or purposes unrelated to the service. Storage: THGO.hu may store access and refresh tokens and necessary Google account identifiers to maintain synchronisation. These are used solely for that purpose. Disclosure: THGO.hu does not sell user data obtained through Google APIs. Data may be disclosed to third parties only when necessary to provide the service requested by the User, with the User’s consent or where required by law. Disconnecting: Users may disconnect Google Calendar within THGO.hu or revoke access in their Google account permissions. THGO.hu ceases to use revoked Google access once disconnected. Google API Services User Data Policy: THGO.hu states that its use and disclosure of Google API data comply with this policy, including Limited Use requirements, and that access is used exclusively for the visible Calendar synchronisation feature chosen by the User.

The System may process log data to maintain security and accountability, prevent unauthorised access and troubleshoot errors. Logged information may include the time of login and logout, IP address, failed login attempts, access-right changes, document uploads, deletions, financial transactions and other administrative events.

To operate the System, the controller may engage processors and other external providers, including hosting, VPS, email, payment, security, logging and technical service providers. The controller must identify the providers actually used, their contact details and responsibilities, and any transfers to third countries, on the basis of the actual service arrangements.

Personal data may be shared with third parties only with a valid legal basis and to the necessary extent. Where a provider processes personal data outside the European Economic Area, the controller must ensure appropriate safeguards under the GDPR and inform the individuals concerned.

Personal data may be kept as long as needed for the processing purpose or required by law. The period may depend on contracts, accounting or tax law, condominium recordkeeping obligations, civil limitation periods, security requirements and legal claims.

Depending on the circumstances, individuals may request information, access, rectification, erasure or restriction; exercise data portability; object to legitimate-interest processing; and withdraw consent at any time where consent is the basis. Statutory retention duties may prevent immediate erasure.

Individuals may send privacy requests to the controller using its published contact details. Requests will be examined within the deadlines and conditions of the GDPR. Identity verification may be required to prevent disclosure to unauthorised parties.

Individuals may lodge a complaint with the competent data protection authority or go to court. In Hungary, the supervisory authority is the National Authority for Data Protection and Freedom of Information (NAIH). Current contact information must be checked before publication.

The controller and technical operator seek to protect the confidentiality, integrity and availability of personal data using risk-appropriate technical and organisational measures, such as HTTPS/TLS, access controls, email verification, logs, backups, updates and prevention of unauthorised access.

The application may use session, security and other technical cookies required for operation. If non-essential cookies are used, for example for analytics or marketing, separate information and, where legally required, appropriate consent management must be provided.

The controller may revise the notice when laws, the service, technology or processing practices change. The current version displays its amendment date. Earlier versions may be archived as PDF files and retrieved by the Super Administrator.

When starting a SimplePay payment, THGO transfers the payer’s email address, billing address and shipping address to SimplePay Zrt. insofar as they are actually necessary for the payment. THGO does not request or store the full card number, CVC/CVV code or authentication secrets entered on the SimplePay payment page. THGO may process the transaction ID, status, payment time and details needed for accounting reconciliation received from SimplePay. Repeated collection of the email, billing and shipping details on the payment page may be disabled if these details are already available in THGO.

I acknowledge that the following personal data stored in the user database of https://thgo.hu by BI88 Kft. (4029 Debrecen, Munkácsy Mihály utca 7, ground floor 1, Hungary), as data controller, will be transferred to SimplePay Zrt. as data processor: email address, billing address and shipping address. The nature and purpose of the processing performed by the processor are described in the SimplePay Privacy Notice at: https://simplepay.hu/adatkezelesi-tajekoztatok/

THGO.HU is also available through an Android application. Some features of the website are shown in an embedded WebView; personal data processed through condominium, resident, financial, utility, messaging and document features are therefore handled for essentially the same purposes as on the web service. Communication between the application and THGO.HU servers is encrypted using HTTPS. Users see only data available under their permissions. The app may be distributed through Google Play. Google may process data under its own privacy terms to operate the Play Store and enable installation, updates, security checks and Google account services. Google’s current privacy notice governs Google’s own processing.

The THGO.HU Android app may use Google Firebase Cloud Messaging (FCM) for push notifications. The app may generate a token associated with the installation and device, and THGO.HU may store it in association with the logged-in User to deliver notifications. Tokens and required technical identifiers are processed solely to provide notifications, deliver messages and handle technical delivery failures. Google/Firebase may process technical data subject to its own service and privacy terms. Users may disable THGO.HU notifications at any time in Android settings. Disabling notifications alone does not prevent use of the app’s core functions that do not depend on notifications.

Depending on the User’s role, permissions and features used, the THGO.HU app may process names, email addresses, User and resident IDs; condominium and resident records; financial records concerning common charges, balances, payments and accounting; utility and meter data; resident messages, support or “Can I Help?” conversations; workflows; and uploaded files and documents. Purposes include providing THGO.HU services, authenticating Users and verifying permissions, supporting condominium management and statements, sending notifications, providing support, maintaining security, investigating errors and complying with statutory and contractual duties. THGO.HU does not store full card numbers or CVC/CVV codes where card payments take place on a SimplePay-operated page. The SimplePay sections of this Notice also apply. Data subjects may request deletion of personal data or closure of an account through THGO.HU support. Deletion does not extend to data that must be retained because of law, accounting duties, legal claims or another mandatory legal basis. Requests are handled according to the parties’ actual controller/processor roles and applicable law.

For resident, owner, utility and financial data uploaded for condominium management, the controller is the entity determining the purposes and essential means of processing. Where THGO performs technical processing under the documented instructions of the condominium or manager, it may act as processor. BI88 Kft. may be an independent controller for its own registration, contractual, support and security processing. Processing activities must be governed by a separate agreement complying with Article 28 GDPR, specifying instructions, access, subprocessors, security measures, incident handling, return of data and deletion.

The final processing records must assign to each processing activity the data categories, purpose, GDPR legal basis, recipients and deletion or review period. User accounts: identification and permissions necessary for the service, for the duration of the account and such subsequent retention as is justified and lawfully determined. Invoices and accounting documents: compliance with legal obligations for the relevant accounting and tax retention periods. Security logs: documented legitimate interest or another appropriate basis, with a predetermined purpose-specific deletion period. Condominium records: the purposes and legal bases determined by the relevant controller. Actual periods and any legitimate-interest assessments must be finalised after checking technical settings and the condominiums’ legal obligations; this Notice does not replace the internal processing records.

The referral programme may process the referrer’s name, contact details, referral relationship and resident count needed to calculate benefits. Before approaching a referred third party, an appropriate legal basis for the processing and electronic communication must be verified. Where an invoicing or online payment provider is used, only data necessary for the operation may be transferred. The actual data-protection roles of Billingo and SimplePay, fields transferred and retention periods must be assessed against contracts and technical data flows. Each provider’s current privacy notice also applies to its processing.

The current version of this Privacy Notice is identified by the “Modified” date and time and the version number in the document header. Earlier versions are identified by their own version numbers and timestamps. Changes take effect only after appropriate publication and fulfilment of applicable legal requirements. Material changes to processing practices require notification to data subjects as prescribed by law.

Az Adatkezelő az adatkezelési tájékoztató lényeges változásairól a regisztrált felhasználókat a regisztrációkor megadott e-mail-címükön, a tervezett alkalmazásukat legalább 30 nappal megelőzően tájékoztatja. Az értesítés tartalmazza a módosított tájékoztató elérhetőségét, a közzététel napját, az alkalmazás tervezett kezdőnapját, valamint a változások lényegét. Ha valamely módosítás jogszabály vagy hatósági kötelezés alapján rövidebb határidővel szükséges, a tájékoztatásra a jogszerűen lehetséges leghamarabbi időpontban kerül sor. A tájékoztató módosítása önmagában nem jelent hozzájárulást olyan adatkezeléshez, amelyhez külön hozzájárulás vagy más jogalap szükséges.