Privacy policy

The short version

We collect what we need to answer your message and run your tour, and nothing else. We do not sell your data, we do not run advertising trackers, and our website analytics do not use cookies or identify you.

Who is responsible

Walks of Budapest is the data controller. Contact us atinfo@walksofbudapest.com.

To be completed: registered company name, seat and registration number.

What we collect, and why

When you send an enquiry

Your name, email address, and optionally your phone number, preferred date, group size and message. We use this to reply to you.Lawful basis: steps taken at your request before entering a contract.

When you book a tour

The above, plus the tour, date, time, group size, meeting point and any notes you give us, and a record of the payment. We use this to provide the tour and to meet our accounting obligations.Lawful basis: performance of a contract, and legal obligation for the accounting records.

Payment details

Card details are entered on Stripe's own payment page and never reach our servers. We receive only a payment reference and confirmation of the amount.

When you buy Walks Local

Your name, email address, the dates of your stay, and — once you first write to us — your phone number. We use these to provide the service and to know which conversation belongs to which trip.Lawful basis: performance of a contract.

The messages themselves

Walks Local runs on WhatsApp. We keep a copy of every message in both directions, including any photograph, voice note or location you choose to send. There are two reasons, and neither is analytics: your local needs to see what you have already told them, and we measure how long you waited for an answer because that is the promise the service is sold on.

Your local also keeps a short note about you — where you are staying, what you are interested in, what to avoid — so that you are not asked the same questions twice. You can ask to see it or have it deleted at any time.Lawful basis: performance of a contract.

Please do not send passwords, card numbers or copies of identity documents. We do not need them and we would rather not hold them.

When a reply is drafted with AI

To answer more quickly, your local can ask our system to draft a reply. When they do, the recent part of your conversation, your dates and the note about your preferences are sent to OpenAI, which returns a suggested wording. A draft is never sent to you automatically — your local reads it, edits it and decides. The model is not permitted to invent places or facts, and the material is not used to train it.Lawful basis: our legitimate interest in answering you quickly and accurately. If you would rather we did not do this for your conversation, say so and we will turn it off for you.

When you visit the site

Our hosting provider processes standard server request data — the page asked for, the time, a rough location from the network — to deliver the site and protect it from abuse. This happens for everyone and is not something we can switch off; it is how a website works.

Recordings and heatmaps, only if you say yes

If you accept when we ask, we record how the site is used: where you click, how far you scroll, which pages you move between, your approximate location, and your browser and screen size. The recording is played back as an anonymous cursor moving over the page. It is done byMicrosoft Clarity, and we use it to find out which parts of the site confuse people.

What is never recorded: anything you type into a form. Every form on this site is masked at the source, so your name, email address, phone number and any notes you write are replaced before they leave your browser. We also never record the pages that show private messages — your own trip page, and our staff console — because your permission is not permission from the people you are talking about.

Nothing is recorded until you accept, and nothing is loaded into the page until then either. Saying no is one click, the same as saying yes, and closing the banner without answering counts as no.Lawful basis: your consent, which you can take back below at any time.

Turn recording onTurn recording off

Cookies

This site sets no advertising cookies and never has. What it does set:

• Strictly necessary: the anti-spam check on our forms (Cloudflare Turnstile) may set a short-lived technical cookie; the dates you give us are kept in a cookie so the site can show you what is on while you are here; and, if you buy Walks Local, one that keeps you signed in to your own trip page. None of these need your permission and none of them follow you anywhere.
• Your answer about recording: one cookie remembering whether you said yes or no, so we do not ask again. Set only once you answer.
• Analytics, only after you accept: Microsoft Clarity sets its own cookies to recognise a returning session. Nothing is set before you accept, and refusing sets none of them.

Who else processes your data

• Cloudflare — website hosting, database, form anti-spam and cookieless analytics.
• Stripe — payment processing. Stripe is the controller of your payment data; see Stripe's own privacy policy.
• Resend — sending confirmation and enquiry emails.
• Meta Platforms Ireland — delivering Walks Local messages over WhatsApp. Meta processes your phone number and the content of what you send. WhatsApp's own terms and privacy policy apply to you as its user, in addition to this one.
• OpenAI — drafting suggested replies for your local, as described above. Only used when a draft is requested.
• Microsoft Clarity — recordings and heatmaps, and only for visitors who have accepted. Nothing reaches Microsoft from anyone who has not.

Some of these providers are based outside the EU. Where data leaves the EEA it is transferred under the European Commission's Standard Contractual Clauses.

How long we keep it

• Enquiries that do not become bookings: up to 24 months, then deleted.
• Booking and payment records: kept for the period Hungarian accounting law requires.
• Email correspondence: as long as it is useful to the relationship, then deleted.
• Recordings and heatmaps: kept by Microsoft Clarity under its own retention period, currently around a year. Withdraw your consent above and we stop sending anything new.
• Walks Local conversations, your phone number and the note about your preferences: deleted automatically fourteen days after your stay ends. This runs on a schedule and is not something we decide case by case — a conversation about a holiday that has happened has no purpose and is only a risk to you.

To be confirmed with an accountant: the exact statutory retention period.

Your rights

Under the GDPR you can ask us for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, and ask for it in a portable format. Write to info@walksofbudapest.comand we will respond within one month.

If you think we have handled your data badly, you can complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), or to the supervisory authority where you live.

Reviews and photographs

We may ask you after a tour whether you would leave a review. Reviews are entirely voluntary, we never offer anything in exchange for one, and we do not ask you to make it positive. If we would like to use a photograph of you in our marketing, we will ask you first.

Children

We do not knowingly collect data about children directly. Bookings for families are made by an adult, who provides any details about children taking part.