Privacy policy

The short version

We collect what we need to answer your message and run your tour, and nothing else. We do not sell your data. Our own website analytics do not use cookies or identify you. Google's and Meta's advert measurement loads only if you say yes to it, and not at all if you say no.

Who is responsible

The data controller is the business named below. Write to us about anything in this document at info@walksofbudapest.com.

Trading name

Walks of Budapest

Registered name

Night Eagle Studios Kft.

Registered seat

2000 Szentendre, Kadarka utca 21.

Registration number

13-09-210010

Tax number

28994372-2-13

Email

info@walksofbudapest.com

Telephone

+36 70 416 2701

We are a two-person business and have not appointed a data protection officer. Regulation (EU) 2016/679 (GDPR) Article 37 does not require one here: our core activity is guiding tours, not monitoring people, and we process no special categories of data at scale.

What we collect, and why

When you send an enquiry

Your name, email address, and optionally your phone number, preferred date, group size and message. We use this to reply to you.Lawful basis: steps taken at your request before entering a contract.

When you book a tour

The above, plus the tour, date, time, group size, meeting point and any notes you give us, and a record of the payment. We use this to provide the tour and to meet our accounting obligations.Lawful basis: performance of a contract, and legal obligation for the accounting records.

Payment details

Card details are entered on Stripe's own payment page and never reach our servers. We receive only a payment reference and confirmation of the amount.

When you buy Walks Local

Your name, email address, the dates of your stay and your WhatsApp number, which we ask for when you buy because the service is a WhatsApp conversation. We use these to provide the service and to know which conversation belongs to which trip.Lawful basis: performance of a contract.

The messages themselves

Walks Local runs on WhatsApp. We keep a copy of every message in both directions, including any photograph, voice note or location you choose to send. There are two reasons, and neither is analytics: your local needs to see what you have already told them, and we measure how long you waited for an answer because that is the promise the service is sold on.

Your local also keeps a short note about you — where you are staying, what you are interested in, what to avoid — so that you are not asked the same questions twice. You can ask to see it or have it deleted at any time.Lawful basis: performance of a contract.

Please do not send passwords, card numbers or copies of identity documents. We do not need them and we would rather not hold them.

When a reply is drafted with AI

To answer more quickly, your local can ask our system to draft a reply. When they do, the recent part of your conversation, your dates and the note about your preferences are sent to OpenAI, which returns a suggested wording. A draft is never sent to you automatically — your local reads it, edits it and decides. The model is not permitted to invent places or facts, and the material is not used to train it.Lawful basis: our legitimate interest in answering you quickly and accurately. If you would rather we did not do this for your conversation, say so and we will turn it off for you.

When you visit the site

Our hosting provider processes standard server request data — the page asked for, the time, a rough location from the network — to deliver the site and protect it from abuse. This happens for everyone and is not something we can switch off; it is how a website works.

When you sign in to your account

There are no passwords on this site. You give us an email address, we send a link to it, and clicking the link proves you can read mail at that address — which is the whole of what an account here means. We never store a password, so there is none to leak, and none you might be reusing somewhere that already has been breached.

The account row holds your email address, the language you were reading in, which version of the terms you accepted and when, and the time you were last seen. Nothing else. The sign-in link itself is a random value that works once, expires after twenty minutes, and is deleted from our side the moment it is used — a forwarded email cannot let anybody in twice.

Staying signed in is a cookie your browser holds. It is marked HttpOnly, so no script on the page can read it, and it lasts sixty days or thirty days of not being used, whichever comes first. Signing out deletes it here as well as in your browser, and "sign out everywhere" ends every session on every device — the thing to do if you signed in on somebody else's laptop.

Your account shows you your bookings, your enquiries and your Walks Local stays, matched on your email address. It shows you nothing that is not yours: every query is scoped to the account the session belongs to, and there is no page here that takes somebody else's reference and looks it up.

Getting it all, and getting rid of it. Signed in, you can download everything we hold about you as a file, and you can delete your account. Deleting it removes the account, its sessions and its sign-in links immediately. It does not delete the record of a booking you actually made: Hungarian accounting law requires those to be kept, and we would rather say so than imply a clean sweep we cannot perform. What does change is that nobody can sign in to look at them again. The mailing list is a separate decision with its own one-click exit, so deleting your account does not unsubscribe you — and the page tells you that at the time rather than leaving you to assume either way.

When you join the mailing list

We store your email address, the language you were reading in, when you agreed, and the exact sentence you agreed to — so that changing the wording on the site later cannot rewrite what you actually said yes to.

Joining takes two steps on purpose. Typing an address into the box creates nothing but an unconfirmed entry, and the only email that entry can ever receive is the one asking whether you meant it. If nobody clicks that link, we never write again. This is what stops somebody putting your address into our footer and signing you up.

This list is separate from the trip reminders below, and the two are never merged. If you asked us to tell you what is on during your dates, that is all you get; you are not on the mailing list unless you joined it yourself. Every email carries a one-click unsubscribe that needs no account, and unsubscribing deletes your address rather than moving it to a list of people who asked to be left alone.

Counting visits, without a cookie and without knowing who you are

We count how many people are reading the site, which pages they are on, how far down a page they get, and which of a small number of buttons we have labelled ourselves get clicked. This runs for everyone and does not ask permission, because there is nothing to ask about: it stores nothing at all on your device — no cookie, no local storage — and it never learns who you are.

Here is exactly how it works, because "anonymous analytics" is a claim people make loosely. When a page opens, your browser makes up a random number and keeps it in memory. It is sent with each of these counts so that one person reading for ten minutes is not counted as thirty people. It is never written to your device, it is different on every page you open, and when you close the tab it is gone. On our side it is deleted within five minutes, automatically, whatever else is happening.

Along with it we record the page address, whether the screen is a phone or a larger one, the two-letter country your network appears to be in, the website you followed a link from, if any, and whether you arrived by clicking one of our Google adverts — only that you did, not the click's own identifier. We do not store your IP address, your browser version, or anything else that could be combined into a fingerprint. Beyond that five-minute window, all that is left are totals: "this page was opened fourteen times today". There is no record, anywhere, of one person's path through the site.

Pages that are about one person specifically — your trip page, the booking confirmation, anything under our admin — are not counted at all.

Recordings and heatmaps, only if you say yes

If you accept when we ask, we record how the site is used: where you click, how far you scroll, which pages you move between, your approximate location, and your browser and screen size. The recording is played back as an anonymous cursor moving over the page. It is done byMicrosoft Clarity, and we use it to find out which parts of the site confuse people.

What is never recorded: anything you type into a form. Every form on this site is masked at the source, so your name, email address, phone number and any notes you write are replaced before they leave your browser. We also never record the pages that show private messages — your own trip page, and our staff console — because your permission is not permission from the people you are talking about.

Nothing is recorded until you accept, and nothing is loaded into the page until then either. Saying no is one click, the same as saying yes, and closing the banner without answering counts as no.Lawful basis: your consent, which you can take back below at any time.

Turn recording onTurn recording off

Knowing whether our adverts work, only if you say yes

We pay for adverts on Google and on Meta (Facebook and Instagram). To learn whether one of them led to an enquiry, we ask a second, separate question. If you accept it, the page loads Google Analytics and theMeta Pixel. Both set cookies in your browser. Google and Meta then receive what any website receives from your browser (such as your IP address), the pages you open here, the advert you arrived from if there was one, and whether you sent an enquiry, tapped our WhatsApp link or tapped our phone number. With an enquiry we send the tour it was about and the price shown — never your name, email address, phone number or anything else you typed.

What they may do with it: Google and Meta are large advertising companies and use what they receive under their own privacy policies, including linking it to an account you are signed in to with them. We have not asked you for personalised advertising and have that switched off on our side of Google's tag; we do not build audiences to follow you around with adverts.

Nothing is measured until you accept, and neither tag is loaded into the page until then. This answer is separate from the one about recordings: saying yes to one is not saying yes to the other. Pages that show private messages are never measured, whatever you answered.Lawful basis: your consent, which you can take back below at any time.

Turn advert measurement onTurn advert measurement off

What allows us to do any of this

Under Regulation (EU) 2016/679 (GDPR) every use of your data needs a lawful basis. Ours, purpose by purpose:

Booking a tour

Article 6(1)(b) — performing the contract you asked for.

Answering an enquiry

Article 6(1)(b) — steps before a contract, at your request.

Keeping booking records

Article 6(1)(c) — a legal obligation. 2000. évi C. törvény a számvitelről sets how long.

Handling a complaint

Article 6(1)(c) — 1997. évi CLV. törvény 17/A–17/B. §.

Your account

Article 6(1)(b) — you asked to sign in and see your own bookings.

Mailing list

Article 6(1)(a) — consent, which you gave by clicking the link in the confirmation email and can withdraw in one click.

Trip reminders

Article 6(1)(a) — consent, separately given and separately withdrawn.

Recordings and heatmaps

Article 6(1)(a) — consent, which is why nothing loads until you answer.

Advert measurement

Article 6(1)(a) — consent, asked separately from recordings and withdrawn separately.

Counting visits

Article 6(1)(f) — our legitimate interest in knowing whether the site works. Nothing stored identifies you, nothing is written to your device, and the per-reader row is deleted within five minutes.

Keeping the site up

Article 6(1)(f) — serving pages and stopping abuse. This is how a website works. To stop our forms being used to send mail to strangers, we count requests for an hour per email address and per network, each under a shortened one-way code that cannot be turned back into the address or the network; the counters are deleted within two hours.

Where the basis is consent, refusing costs you nothing else on this site, and withdrawing it is as easy as giving it.

Cookies

Until you say yes to advert measurement, this site sets no advertising cookies. What it does set:

• Strictly necessary: the anti-spam check on our forms (Cloudflare Turnstile) may set a short-lived technical cookie; the dates you give us are kept in a cookie so the site can show you what is on while you are here; and, if you buy Walks Local, one that keeps you signed in to your own trip page. None of these need your permission and none of them follow you anywhere.
• Staying signed in: one cookie holding a random session value, set only when you sign in and deleted when you sign out. HttpOnly, so no script can read it.
• Your answers: one cookie remembering whether you said yes or no to recording, and one for advert measurement, so we do not ask again. Each is set only once you answer that question.
• Analytics, only after you accept: Microsoft Clarity sets its own cookies to recognise a returning session. Nothing is set before you accept, and refusing sets none of them.
• Advert measurement, only after you accept: Google Analytics and the Meta Pixel set their own cookies (their names begin _ga, _gcl and _fbp) to recognise a returning browser and the advert it came from. Nothing is set before you accept, and refusing sets none of them.
• Tripadvisor reviews, only if you ask for them: the homepage can show our latest Tripadvisor reviews. They load from Tripadvisor, which may set its own cookies, only when you press "Show Tripadvisor reviews". Until then the page does not contact Tripadvisor.
• Our own counting sets no cookie at all. The visit counting described above works entirely without one, which is why it is not behind the question. If you refuse recordings and advert measurement, that counting still happens — and it still does not know who you are.

Who else processes your data

• Cloudflare — website hosting, database and form anti-spam. Our own visit counting is stored in our own database on Cloudflare; it goes to no third party.
• Stripe — payment processing. Stripe is the controller of your payment data; see Stripe's own privacy policy.
• Resend — sending confirmation and enquiry emails.
• Meta Platforms Ireland — delivering Walks Local messages over WhatsApp. Meta processes your phone number and the content of what you send. WhatsApp's own terms and privacy policy apply to you as its user, in addition to this one.
• OpenAI — drafting suggested replies for your local, as described above. Only used when a draft is requested. Also, to keep your booking up to date with what our guide writes in his own calendar (a new time, a note such as a meeting point): when he writes an entry, its text is sent to OpenAI together with a short list of upcoming bookings — reference, first and last name, date, time, tour and group size, never your phone number, email address or payments — so that it can tell which booking the entry is about. Entries that are not about a tour are discarded. The material is not used to train the model.
• Microsoft Clarity — recordings and heatmaps, and only for visitors who have accepted. Nothing reaches Microsoft from anyone who has not.
• Google Ireland — Google Analytics and Google Ads conversion measurement, and only for visitors who have accepted advert measurement. No measurement data reaches Google from anyone who has not.
• Google Ireland (Google Calendar) — our guide's calendar. When you book a tour, the guide's Google Calendar gets an entry for it so that he has the day on his phone: the tour, its date and time, the size of your group, your name, your phone number (or your email address if you gave no phone number), the meeting point, the booking reference and what has been paid. Anything you wrote in the notes box is not sent there; the entry only says that there is a note. While a request is still open, before it is a booking, the guide's calendar shows it as a request: your name, the tour, the date and time you asked for, the size of your group and the request's reference — none of your contact details. The guide also gets a reminder on his phone the day before and the hour before; it is encrypted end to end, so the service that delivers it (Apple's, Google's or Mozilla's) cannot read it.
• Meta Platforms Ireland — the Meta Pixel, again only for visitors who have accepted advert measurement. This is separate from the WhatsApp delivery above.
• Tripadvisor — the reviews widget on the homepage, and only for visitors who press the button to show it. Tripadvisor then receives what any website receives from your browser (such as your IP address) and its own privacy policy applies.

Some of these providers are based outside the EU. Where data leaves the EEA it is transferred under the European Commission's Standard Contractual Clauses.

How long we keep it

• Enquiries that do not become bookings: up to 24 months, then deleted.
• Accounts: until you delete the account. Sign-in links are deleted when used or after twenty minutes; sessions after sixty days, or thirty days of not being used. An address that asked for a sign-in link and never used one is deleted after thirty days — it never became an account.
• Mailing list: until you unsubscribe, which deletes your address. An entry that is never confirmed is deleted after seven days — it was never a subscription.
• Visit counts: the per-reader row lasts five minutes. The daily totals carry no identifier at all and are kept.
• Booking and payment records: 8 years, because 2000. évi C. törvény a számvitelről requires it. This is why deleting your account does not delete them.
• Email correspondence: as long as it is useful to the relationship, then deleted.
• Recordings and heatmaps: kept by Microsoft Clarity under its own retention period, currently around a year. Withdraw your consent above and we stop sending anything new.
• Advert measurement: kept by Google and by Meta under their own retention periods. Withdraw your consent above and we stop sending anything new.
• The guide's calendar: a tour's entry is taken out of the guide's Google Calendar when the booking is cancelled, and otherwise thirty days after the tour. A request's entry is taken out when the request becomes a booking or is closed, and when its date has passed. This happens automatically.
• Walks Local conversations, your phone number and the note about your preferences: deleted automatically fourteen days after your stay ends. This runs on a schedule and is not something we decide case by case — a conversation about a holiday that has happened has no purpose and is only a risk to you.

To be confirmed with an accountant: the exact statutory retention period.

Your rights

You can ask us for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, ask for it in a portable format, and withdraw any consent you gave. Write to info@walksofbudapest.com and we answer within one month.

Two of those you can do yourself, right now, without writing to anybody: on your account page you can download everything we hold about you as a file, and you can delete your account. What deletion does and does not reach is set out above.

If you think we have handled your data badly, complain to us first — and if that does not settle it, to the supervisory authority. In Hungary that is:

Authority

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

In English

Hungarian National Authority for Data Protection and Freedom of Information

Seat

1055 Budapest, Falk Miksa utca 9-11.

Post

1363 Budapest, Pf.: 9.

Telephone

+36 1 391 1400

Email

ugyfelszolgalat@naih.hu

Web

https://naih.hu

If you live in another EU country you can complain to your own supervisory authority instead. You can also go to court, in Hungary or where you live.

Reviews and photographs

We may ask you after a tour whether you would leave a review. Reviews are entirely voluntary, we never offer anything in exchange for one, and we do not ask you to make it positive. Where we publish one on this site we print it as it was written, in the language it was written in, with a translation marked as a translation, and we say where it came from.

The photographs on our home page and about page were taken on real tours and show real guests. They are published with those guests' permission, and they carry no location data — it is stripped from every file before it goes up. If you are in one and would rather not be, tell us and it comes down; you do not have to give a reason and we will not ask for one.

Children

We do not knowingly collect data about children directly. Bookings for families are made by an adult, who provides any details about children taking part.