1. The data controller
The operator of the LeasingTrack service (the Service) — the Provider, or "we" — is the controller under the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) for the processing described in this notice, except where we act as a processor as explained in the next section. Our details:
2. Who this covers, and who the controller is
This notice covers registered Users of the Service (landlords, co-owners and tenants), newsletter subscribers, people who write to us through the contact form, and visitors to the public pages.
When a landlord records other people's personal data in the Service — for example their tenants' or co-owners' (leases, payments, documents, inspection reports, maintenance requests, messages) — the landlord is the controller of that data, and the Provider is a processor under Article 28 GDPR, processing it on the landlord's behalf and only to provide the Service. If you are a tenant and want to exercise your rights over such data, please contact your landlord first; we will help them fulfil your request.
This division of roles is also set out in the "Your data" section of the Terms of Service.
3. What we process, why, and on what basis
Below, for each processing activity, is a summary of the data involved, what we use it for, the legal basis, and how long we keep it. Legal bases refer to the points of Article 6(1) GDPR.
Your account
- Data
- Name, email address, phone number (optional), profile photo (optional — uploaded by you, or taken over from your Google account), interface language, account role and creation date.
- Purpose
- Creating and running your account, signing in, identifying you and staying in touch with you (for example notifications and password resets).
- Legal basis
- Performance of a contract — GDPR Article 6(1)(b).
- Kept for
- Until the account is deleted. If the account's email address is never confirmed, the account is deleted 180 days after sign-up; we send a reminder by email at least 14 days before.
Emergency contact
- Data
- Name and phone number of the person to notify in an emergency. Optional.
- Purpose
- So that someone can be reached in an emergency (for example a burst pipe or an accident).
- Legal basis
- The legitimate interest of the User and of the person concerned — point (f). Please only add someone's details with their knowledge.
- Kept for
- Until you remove it from your profile, at the latest until the account is deleted.
Sign-in and account security
- Data
- A one-way hash of your password; the public key, name and last use of your passkeys; two-step verification settings (the authenticator app secret is stored encrypted); a hash of your recovery phrase; hashes of one-time codes sent by email; the time of your last password change; the time of your last sign-in. For a connected Google account: Google's account ID, the email address it reported, and when it was connected and last used.
- Purpose
- Protecting your account from unauthorised access, secure sign-in and account recovery.
- Legal basis
- Performance of a contract — point (b); legitimate interest in the security of the Service — point (f).
- Kept for
- Settings until you switch them off, at the latest until the account is deleted; one-time codes are deleted automatically one day after they expire.
Accepting the Terms of Service
- Data
- When you accepted the Terms of Service, and which version.
- Purpose
- Proving that the User read and accepted the terms when signing up.
- Legal basis
- Legitimate interest in proving the contract was concluded — point (f).
- Kept for
- Until the account is deleted.
Properties, leases, finances and communication
- Data
- Property details and photos; leases and their terms; names and email addresses of tenants and co-owners; rent, payments and other transactions; uploaded documents; move-in and move-out inspections; maintenance requests and their history; messages; notifications and notification settings.
- Purpose
- Providing the Service: keeping track of the rental and the communication between landlords, co-owners and tenants.
- Legal basis
- For your own data, performance of a contract — point (b). For other people's data recorded by a landlord, the landlord is the controller and determines the legal basis; we act as a processor.
- Kept for
- Until the User deletes it, at the latest until the account is deleted. If a landlord is required by law to keep something longer (for example accounting records), they keep their own copy.
Newsletter
- Data
- Name, email address, language, where you subscribed (website or account), and when you subscribed, confirmed and unsubscribed.
- Purpose
- Sending the newsletter about product news and landlord tips.
- Legal basis
- Consent — point (a), in line with Section 6 of Hungarian Act XLVIII of 2008 on commercial advertising. We ask you to confirm by email, and you can withdraw your consent at any time.
- Kept for
- Until you unsubscribe. Unconfirmed sign-ups are deleted after 30 days. After you unsubscribe we keep the fact that you did, so we never email you again by mistake; we delete that too on request.
Feedback when deleting an account
- Data
- The reason and comment you choose to give when deleting your account, the account's age in days, and whether it owned a property. Stored anonymously: neither your name nor your email address is linked to it.
- Purpose
- Understanding why people leave, and improving the Service.
- Legal basis
- Consent — point (a): the question is optional and you can leave the comment empty.
- Kept for
- Two years, then deleted automatically. Please don't put personal data in the comment.
Contact form
- Data
- Name, email address, and the subject and text of your message.
- Purpose
- Answering your enquiry, and emailing you a copy of your message so you have a record of it.
- Legal basis
- Legitimate interest in answering enquiries — point (f); for questions about your use of the Service, performance of a contract — point (b).
- Kept for
- The message isn't stored in the Service's database: it arrives as an email in the Provider's mailbox, where we keep it until the matter is closed.
Site statistics (our own, without cookies)
- Data
- The pages you view (their general address, without IDs, link codes or anything after the question mark), when and for how long, how far you scroll, the links and buttons you click (on the public pages with their text, inside the Service without it), the site and campaign that referred you; your browser, operating system, device type, screen size, language and time zone (we derive your country from the time zone); your IP address with its last part removed; if you are signed in, your account. A visitor is recognised within one day only, by a code computed from the IP address and the browser that cannot be traced back once the day is over. Nothing is stored in your browser for this.
- Purpose
- Understanding how visitors and Users find and use the Service, which pages work and which don't, and recognising bots and abuse — so we can improve it.
- Legal basis
- Legitimate interest in measuring and improving our own service — point (f). The statistics are used only by us, are never shared or combined with other sources, and no cookie or other data is stored on your device for them, so no consent is asked. Every visit is measured, whether or not you allow Google Analytics cookies; signals sent by browsers (such as Global Privacy Control or Do Not Track) are not taken into account. You can object under Article 21 on grounds relating to your particular situation by writing to us (see “Your rights”).
- Kept for
- 25 months, then deleted automatically; page requests seen by the server (mostly search engines and other bots) 90 days. The daily code used to recognise a visitor is deleted at the end of each day. The visits linked to your account are part of your data export and are deleted with your account.
Usage statistics (Google Analytics)
- Data
- Only if you allow analytics cookies: a random identifier kept in the _ga cookies; the pages you view (their general address, without IDs or link codes), when and for how long; the site that referred you; your device and browser type, screen size and language; your approximate location (country, city) derived from your IP address; and a few actions — signing up, signing in, opening the demo, sending the contact form. Never your name, email address or anything you store in the Service.
- Purpose
- Understanding how visitors and Users find and use the Service, so we can improve it.
- Legal basis
- Consent — point (a), and Section 155(4) of Hungarian Act C of 2003 on electronic communications. Nothing is collected before you consent, and you can withdraw your consent at any time under “Cookie settings” at the bottom of every page.
- Kept for
- The _ga cookies expire after at most 2 years and are deleted from your browser when you withdraw your consent. Google Analytics keeps the statistics for 14 months. Your choice itself is kept in your browser and asked again after a year.
Technical data and abuse prevention
- Data
- IP address, technical data sent by your browser (such as the browser type), and the time of requests; on the sign-in, sign-up, password reset, account recovery and contact forms, when switched on, the Google reCAPTCHA assessment.
- Purpose
- Keeping the Service secure: filtering out overload, bots and abuse.
- Legal basis
- Legitimate interest in the security of the Service and its Users — point (f).
- Kept for
- Rate-limit counters only exist in the server's memory, for a few minutes at most. The database stores IP addresses only with their last part removed, for the site statistics (see above); reCAPTCHA assessments are never stored.
4. Who can access the data
We never sell personal data or pass it on for advertising. At the Provider, only people who need it for their work can access it.
The Service also shows data between Users, always according to their access: a landlord sees the name and email address of the Users they invited as tenants, a tenant sees their landlord's name and the lease details that concern them, and co-owners see the data of the shared property.
We only disclose data to authorities or courts where the law requires us to.
The following providers process data to run the Service:
Hosting
- Provider
- Name and contact details available on request.
- Role
- Storing and running the Service, its database and uploaded files.
Email delivery
- Provider
- Name and contact details available on request.
- Role
- Delivering notifications, security emails and newsletters.
Google Analytics
- Provider
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland)
- Role
- Usage statistics about the Service, when switched on and only if you allow analytics cookies. Google processes the data listed under “Usage statistics” and may transfer it to the United States; Google LLC is certified under the EU–US Data Privacy Framework. Google signals and advertising features are off. Google Privacy Policy (new tab)
Google reCAPTCHA
- Provider
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland)
- Role
- Filtering out bots on the sign-in, sign-up, password reset, account recovery and contact forms, when switched on. Google processes your IP address and technical browser data and may transfer them to the United States; Google LLC is certified under the EU–US Data Privacy Framework. Google Privacy Policy (new tab)
Google Maps
- Provider
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland)
- Role
- Address suggestions on the property form, and a map of the property's location on the property form and on the property's page, when switched on. Google receives what you type in the address field and the address shown on the map, your IP address and technical browser data, and may transfer them to the United States; Google LLC is certified under the EU–US Data Privacy Framework. Google Privacy Policy (new tab)
Sign in with Google
- Provider
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland)
- Role
- Signing in and signing up with a Google account, if you choose to. Google confirms who you are and tells us your account ID, name, email address and profile picture; Google learns that you signed in to LeasingTrack. Google LLC is certified under the EU–US Data Privacy Framework. Google Privacy Policy (new tab)
5. Keeping and deleting data
How long each kind of data is kept is listed for each activity in the "What we process, why, and on what basis" section. We delete data once that period ends or its purpose no longer applies.
You can delete your account yourself at any time under Settings › Profile, in the “Your data and account” section: after you enter your password we send a confirmation link to your email address, and the account is only deleted once you open the link and confirm. This also deletes the properties you own, with all their records and uploaded files; their co-owners and tenants lose access to them, and we let them know by email. Records of leases you rent from other landlords (such as the lease, messages and requests) stay in that landlord's records, as they are the controller of that data, but are no longer linked to your account. We recommend downloading your data before you delete your account. Where the law requires longer retention (for example accounting records of paid plans under Hungarian Act C of 2000 on accounting), we keep that data only for the required period and use it for nothing else.
Every way to delete your data — including only disconnecting a Google sign-in — is described step by step on the Deleting your data page.
6. Your rights
Under the GDPR you have the following rights:
- Access (Article 15) You can ask whether we process data about you and, if so, get a copy of it.
- Rectification (Article 16) You can ask us to correct inaccurate data and complete incomplete data.
- Erasure (Article 17) You can ask us to delete your data if it is no longer needed, you have withdrawn your consent, or it was processed unlawfully.
- Restriction (Article 18) You can ask us to only store your data and not use it otherwise — for example while a dispute is being resolved.
- Data portability (Article 20) You can receive the data you gave us, processed under a contract or your consent, in a structured, machine-readable format, or ask us to send it to another controller.
- Objection (Article 21) You can object at any time, on grounds relating to your particular situation, to processing based on legitimate interest.
- Withdrawing consent (Article 7) Where processing is based on your consent (the newsletter), you can withdraw it at any time; this does not affect the lawfulness of processing before the withdrawal.
You can submit a request using the data controller's contact details. We reply within one month at the latest; this can be extended by two further months given the complexity or number of requests, in which case we tell you within the first month. Acting on your request is free of charge. Before acting we may verify your identity — for example by asking you to write from the email address of your account.
You can manage some of your data yourself: in your profile you can change your name, phone number, language and emergency contact, and you can unsubscribe from the newsletter with the link at the bottom of every issue or in your account. Under Settings › Profile you can download all your data in a machine-readable (JSON) format at any time, and delete your account there too.
7. Complaints and remedies
If you feel we have infringed your data protection rights, please write to us first — we'll try to put it right quickly.
You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information, or with the data protection supervisory authority of the EU member state where you live, work, or where the alleged infringement took place.
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
- Address
- Falk Miksa utca 9–11, 1055 Budapest, Hungary
- Postal address
- Pf. 9, 1363 Budapest, Hungary
- Phone
- +36 1 391 1400
- [email protected]
- Website
- naih.hu
You can also go to court if your rights are infringed; you may choose to bring the case before the regional court (törvényszék) of your place of residence or stay (Article 79 GDPR; Section 23 of Hungarian Act CXII of 2011 on informational self-determination and freedom of information).
8. Cookies and local storage
The Service sets no cookies of its own and uses no advertising tracking; analytics cookies are set only if you allow them (see below). A few things it needs to work are kept in your browser’s local storage (localStorage), on your own device:
apartment_tracker_language- The interface language you chose.
apartment_tracker_access_tokenapartment_tracker_refresh_token- The identifiers of your signed-in session; removed when you sign out.
apartment_tracker_last_workspace- The workspace you used last (landlord or tenant), so you land there when you sign in.
properties.layoutowner-nav-collapsedtenant-nav-collapsed- Display preferences: the property list view and whether the sidebar is collapsed.
apartment_tracker_theme- The light or dark theme you chose.
apartment_tracker_newsletter_draft- Administrators only: an unfinished newsletter draft.
leasingtrack_app_update_dismissed- Android app only: the app version whose update notice you closed, so it is offered again only for a newer one.
leasingtrack_cookie_consent- Your cookie choice — which optional cookies you allowed, and when — so you are not asked on every page.
These are needed for the Service to work or to remember settings you chose, so we don't ask for separate consent (Section 155(4) of Hungarian Act C of 2003 on electronic communications). You can clear them in your browser settings at any time; the Service then signs you out and uses its default settings.
On the sign-in, sign-up, password reset, account recovery and contact pages, when reCAPTCHA is switched on, Google's script may set its own cookies in your browser; Google's Privacy Policy explains them.
On the property form and on a property's page, when Google Maps is switched on, Google's script and map may set their own cookies in your browser; Google's Privacy Policy explains them.
When Google Analytics is switched on, the Service asks on your first visit whether you allow analytics cookies. Only if you do does Google’s script load and set its _ga and _ga_<ID> cookies, which expire after at most 2 years. Refusing is as easy as accepting, and you can change your choice at any time under “Cookie settings” at the bottom of every page; withdrawing your consent deletes these cookies. The Android app sets no analytics cookies.
The Service's own site statistics use no cookies and store nothing in your browser — a visitor is recognised within one day only, from the IP address and the browser, without a stored identifier.
9. Security
Data is sent over encrypted (HTTPS) connections. Passwords and recovery phrases are only stored as one-way hashes, and authenticator app secrets are stored encrypted. Access is checked on the server for every request, so everyone only sees the data they are entitled to.
If a personal data breach is likely to result in a high risk to your rights, we will tell you without undue delay (Article 34 GDPR).
10. Changes to this notice
We update this notice when the Service or the law changes. The version in force is always on this page, with its effective date at the top.
Registered Users are notified of material changes by email or within the Service before they take effect.
Questions about how we handle your data? Write to us on the contact page.