Effective: 7 September 2026 · Version: 1.0
IGuide Production Kft. (hereinafter: Controller or Service Provider) processes personal data in the course of operating the MyGuide Live platform (hereinafter: Platform). The purpose of this notice is to inform data subjects in accordance with Articles 13–14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
| Item | Detail |
|---|---|
| Company name | IGuide Production Kft. |
| Registered seat | 2013 Pomáz, Horváth u. 4., Hungary |
| Company registration number | 13 09 194493 |
| Tax number | 26385792-2-13 |
| Representative | Gálosné Frey Mónika |
| ig@i-guide.hu | |
| Website | myguidelive.com |
Data protection officer: under Article 37 of the GDPR the Controller is not required to appoint a data protection officer and has not appointed one. For data protection matters, the Controller can be contacted at the email address above.
The Controller processes personal data in accordance with the principles set out in Article 5 of the GDPR: lawfully, fairly and transparently; for specified, explicit and legitimate purposes; limited to what is necessary for the purpose; accurately and kept up to date; stored for no longer than necessary; and with appropriate security measures.
The Controller does not take decisions based solely on automated processing that produce legal effects concerning the data subject or similarly significantly affect them, and does not carry out profiling for marketing purposes.
Data processed: email address, encrypted hash of the password, name or display name, profile picture (optional), user role, time of registration, time of last sign-in. Purpose of processing: creating and maintaining the user account, identifying the User, providing the Service. Legal basis: Article 6(1)(b) GDPR — performance of the contract. Retention period: for the duration of the account, then for 30 days from deletion of the account (so that an erroneous deletion can be reversed), after which erasure. This does not affect data that the Controller is required by law to retain.
Data processed: email address, name, profile picture and account identifier received from the Google account. Purpose: providing a simplified sign-in. Legal basis: Article 6(1)(b) GDPR — performance of the contract, or steps taken at the data subject's request. Retention period: for the duration of the account.
Data processed: name of the business, its registered seat, tax number, registration number, name, email address and telephone number of the contact person, service description, photographs, languages, locations, prices, available dates. Purpose: displaying the partner service on the Platform, handling bookings. Legal basis: Article 6(1)(b) GDPR — performance of the contract. For the publicly displayed profile photo, Article 6(1)(a) GDPR — consent, which may be withdrawn at any time. Retention period: for the duration of the partner relationship, then for 5 years from its termination (general civil-law limitation period).
Data processed: name, email address, telephone number, booking details (date, location, headcount, language), messages relating to the booking, booking status. Purpose: creating the booking, establishing contact between the Tourist and the Guide, performing the service, handling cancellation and refund. Legal basis: Article 6(1)(b) GDPR — performance of the contract. Recipients: the Guide concerned, to the extent necessary for performance. The Guide qualifies as an independent controller with regard to this data and may use it solely to perform the booking. Retention period:
The Controller uses the following processors to provide the Service. A processing agreement under Article 28 of the GDPR is in place with every processor.
| Processor | Registered seat | Activity | Location of data storage |
|---|---|---|---|
| Vercel Inc. | United States | Application hosting, CDN | EU / global CDN |
| Supabase Inc. | United States | Database, authentication, file storage | European Union (Paris) |
| LiveKit Inc. | United States | Real-time audio streaming | European Union (Frankfurt) |
| Stripe Payments Europe, Ltd. | Ireland | Payment services, payout | European Union |
| KBOSS.hu Kft. (Számlázz.hu) | Hungary | Invoicing | Hungary |
| Plus Five Five, Inc. (operator of Resend) | 2261 Market Street #5039, San Francisco, CA 94114, USA |
Under the GDPR, the data subject has the following rights:
Right to information (Articles 13–14): the data subject is entitled to be informed about the processing; this notice serves that purpose.
Right of access (Article 15): the data subject may request information on whether the Controller processes their personal data and, if so, may request a copy of it.
Right to rectification (Article 16): the data subject may request the rectification of inaccurate data and the completion of incomplete data. A registered User can change most of their data themselves in their account.
Right to erasure (Article 17): the data subject may request the erasure of their data where the purpose of the processing has ceased, they have withdrawn their consent, or the processing is unlawful. The right to erasure cannot be exercised where the processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims (for example, in the case of accounting documents).
Right to restriction of processing (Article 18): in certain cases the data subject may request that the Controller only store their data and not otherwise process it.
Right to data portability (Article 20): for data processed by automated means on the basis of consent or a contract, the data subject may request to receive their data in a structured, commonly used, machine-readable format, or to have it transmitted to another controller.
Right to object (Article 21): the data subject may object to processing based on legitimate interest. In that case the Controller ceases the processing unless it demonstrates compelling legitimate grounds that override the interests of the data subject. The data subject may object at any time, without restriction, to processing for direct marketing purposes, and in that case the processing must be stopped immediately.
Right to withdraw consent (Article 7): where processing is based on consent, consent may be withdrawn at any time, free of charge.
The data subject may exercise their rights by a request sent to ig@i-guide.hu or to the Controller's registered seat. The Controller fulfils the request within 1 month at the latest; this deadline may be extended by a further 2 months where justified, of which the Controller informs the data subject within 1 month of receipt of the request.
Before fulfilling the request, the Controller is entitled to verify the data subject's identity if it has reasonable doubts about the identity of the person making the request.
Complaint to the Controller: the data subject may in the first instance contact the Controller at ig@i-guide.hu.
Procedure before the supervisory authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH) Address: 1055 Budapest, Falk Miksa utca 9-11. Postal address: 1363 Budapest, Pf. 9. Phone: +36 1 391 1400 Email: ugyfelszolgalat@naih.hu Website: naih.hu
Judicial remedy: the data subject may turn to the regional court competent for their place of residence or stay. The case falls within the jurisdiction of the regional court.
Under Article 32 of the GDPR, the Controller applies technical and organisational measures proportionate to the risks, in particular:
In the event of a data breach, the Controller notifies the NAIH without undue delay and no later than within 72 hours, unless the breach is unlikely to result in a risk. If the breach is likely to result in a high risk to the rights of data subjects, the Controller also informs the data subjects.
The Platform's services are not directed at persons under the age of 16. The Controller does not knowingly collect personal data from persons under 16. If the Controller becomes aware that it holds such data, it erases it without delay.
Using the Whisper feature as a Listener does not require registration and does not involve providing personal data; a minor may also take part in a tour under the responsibility of their accompanying adult.
The Controller reserves the right to amend this notice unilaterally. The Controller notifies data subjects of the amendment by a notice published on the Platform and, in the case of a material change, also by email, at least 15 days before it takes effect.
The notice in force at any given time is continuously available on the Platform.
Data processed: tour identifier, PIN code, time of joining, technical identifier of the joining device, technical data on connection quality. Purpose: the technical delivery of the audio stream, credit settlement, ensuring the quality of the service. Legal basis: Article 6(1)(b) GDPR — performance of the contract (for a Listener, a contract for a free service), and Article 6(1)(f) GDPR — the Controller's legitimate interest in the technical operation of the service and the prevention of abuse. Retention period: technical log data for 30 days from the end of the tour; data needed for credit settlement for 8 years.
The Controller does not record or store the audio of the tour. The audio stream passes through the service in real time, without storage.
Data processed: time of purchase, name of the package, amount paid, transaction identifier, payment status, billing details (name, address, tax number). Purpose: handling the purchase, maintaining the credit balance, invoicing, handling refunds. Legal basis: Article 6(1)(b) GDPR — performance of the contract; for invoicing, Article 6(1)(c) GDPR — compliance with a legal obligation (Act C of 2000 on accounting, Act CXXVII of 2007 on value added tax). Retention period: for accounting documents, 8 years under Section 169 of Act C of 2000 on accounting.
The Controller does not have access to and does not store bank card data; it is handled directly by the payment service provider.
Data processed: the display name of the person posting, the score and text of the review, the time of posting, the identifier of the related booking. Purpose: displaying reviews, making the quality of the service transparent, checking the authenticity of reviews. Legal basis: Article 6(1)(f) GDPR — the legitimate interest of the Controller and of Users in operating an authentic review system; posting a review is the data subject's voluntary decision. Retention period: until the review is withdrawn or the profile ceases to exist.
Data processed: name, email address, telephone number, content of the enquiry, content of the reply, dates of handling. Purpose: answering enquiries, investigating complaints. Legal basis: Article 6(1)(b) or (f) GDPR; for a consumer complaint, Article 6(1)(c) GDPR — a legal obligation under Section 17/A of Act CLV of 1997 on consumer protection. Retention period: for a consumer complaint and the reply to it, 5 years; for other enquiries, 2 years.
Data processed: the reporter's name and email address, the content of the report, the identifier of the content concerned, the decision taken and its reasons. Purpose: operating the notice and action mechanism under the DSA. Legal basis: Article 6(1)(c) GDPR — compliance with a legal obligation (Articles 16–17 of the DSA). Retention period: 5 years.
Data processed: IP address, time of the request, the endpoint called, browser and operating system type, response status code, error messages. Purpose: the secure operation of the Platform, detecting abuse and attacks, fixing errors. Legal basis: Article 6(1)(f) GDPR — the Controller's legitimate interest in the security of its IT system. Retention period: no more than 30 days, or until the end of the investigation in the case of a security incident.
Data processed: name, email address, time of subscription and the IP address at that time, data on the opening of emails and on clicks on links. Purpose: sending newsletters and marketing content, measuring the effectiveness of campaigns. Legal basis: Article 6(1)(a) GDPR — the data subject's consent, which may be withdrawn at any time, without reasons and free of charge, using the unsubscribe link in the emails or by a message to ig@i-guide.hu. Withdrawal does not affect the lawfulness of processing before the withdrawal. Retention period: until consent is withdrawn. The Controller keeps the data proving that consent was given for 5 years from withdrawal, on the basis of legitimate interest, solely for evidentiary purposes.
Detailed information on the use of cookies is given in the separate Cookie Notice.
| Transactional and newsletter emails |
| United States |
| Google Ireland Limited | Ireland | Sign-in with a Google account | European Union / United States |
Transfers to third countries. The parent company of some processors is located outside the European Union. In these cases, the legal basis for the transfer is the standard contractual clauses (SCC) adopted by the European Commission under Article 46(2)(c) of the GDPR and, where applicable, an adequacy decision under the EU–US Data Privacy Framework. Before the transfer, the Controller examines whether appropriate safeguards are in place.
Email delivery. The Controller sends transactional emails through the Resend service operated by Plus Five Five, Inc.
Other recipients. The Controller may transfer personal data
The Controller does not sell personal data and does not disclose it to third parties for advertising purposes.
Information and action are free of charge. If a request is manifestly unfounded or excessive, the Controller may charge a reasonable fee or refuse to act on the request.