Privacy Notice

Getting in touch about data protection

Please use the same email address for data protection enquiries, requests and complaints, with "Data protection" in the subject line.

The Platform is hosted by Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA; privacy@vercel.com) and served from a region within the European Union.

a) Visiting the Platform and server-side logging

Who it concerns

All visitors

Data processed

Time of the request, the path requested, the HTTP method, the response status code, the running application version identifier, the IP address and the browser identifier (user agent)

Purpose

Keeping the Platform running, detecting and fixing errors, maintaining the security of the service

Legal basis

Legitimate interest — Art. 6(1)(f) GDPR — in the reliable operation of the Platform. We balanced this against your interests and found it proportionate, because the logging covers a narrow data set, is extremely short-lived, and is indispensable to providing the service.

Who performs it

Logging is performed automatically by the hosting provider. The application keeps no separate access log of its own, and no log forwarding to external systems is configured.

Retention

One hour. After that, the IP address associated with a request is retained neither by us nor by the hosting provider. If our service plan changes, this period may become longer under the provider's rules, in which case we will update this notice.

Exception

Technical logs created when the application is deployed are retained indefinitely. They contain no visitor data, only the technical output of the deployment.

b) Abuse prevention

Who it concerns

All visitors

Data processed

The visitor's IP address

Purpose

Preventing automated abuse and overload by limiting how many requests may arrive from the same address in a short period

Legal basis

Legitimate interest — Art. 6(1)(f) GDPR — in protecting the Platform and its users

Retention

Short-lived, until the limiting window expires, after which the record is deleted automatically.

c) Waitlist sign-up

Who it concerns

Waitlist subscriber

Data processed

Email address, time of sign-up, the language selected at sign-up

Purpose

Notifying you when the booking service goes live

Legal basis

Consent — Art. 6(1)(a) GDPR

Retention

Until consent is withdrawn, or until the purpose of the processing ceases

Withdrawal

Every message carries an unsubscribe link, and we action unsubscribes without delay. You can also write to contact@bountr.hu.

d) Newsletter

Who it concerns

Waitlist subscriber, Traveller

Data processed

Name (if provided), email address, the time and content of your consent, and data on opening the newsletter and the links in it

Purpose

Marketing communication: new itineraries, destinations, offers and service news

Legal basis

Consent — Art. 6(1)(a) GDPR — and Section 6(1) of Hungarian Act XLVIII of 2008, which requires prior, unambiguous and explicit consent for advertising by electronic message

Retention

Until consent is withdrawn. After withdrawal we retain the fact and time of the unsubscribe on the basis of legitimate interest, so that we do not contact you again in error.

Withdrawal

A one-click unsubscribe link at the bottom of every newsletter. We action unsubscribes without delay and in any case within three working days.

Subscribing is never a condition of using the service. Without subscribing you can use the Platform and book in exactly the same way.

e) Creating and managing a user account

Who it concerns

Traveller, Expert

Data processed

Required: first and last name, email address, a non-reversible value derived from your password, role, and the date of registration. Your choice: bio, country, city, profile picture, and Instagram, TikTok and website links. For security: the technical data needed to protect the account, and the password recovery code and its expiry.

Purpose

Providing account-based features: saved itineraries, access to past bookings and their expert tips, uploading itineraries, and protecting the account against unauthorised access

Legal basis

Performance of a contract — Art. 6(1)(b) GDPR: by registering, you and Bountr enter into a contract for use of the Platform, governed by the terms and conditions. For the optional profile fields and the profile picture, consent — Art. 6(1)(a) — given by completing them and withdrawable at any time by clearing the field. For processing that protects the account, legitimate interest — Art. 6(1)(f).

Signing in with Google

If you sign in with your Google account, Google informs us of the sign-in and of your basic account details — your name and email address. We do not process a password in that case. Google acts under its own privacy policy.

Retention

Until the account is deleted. After deletion, data may be recoverable for up to six hours because of the system's backup mechanism, after which it is permanently gone. Data we are legally required to retain is kept for the statutory period even after account deletion.

If not provided

The Platform can be browsed without an account, and a booking can be completed as a guest. An account is required to upload an itinerary. The account works without restriction if the optional profile fields are left empty.

f) Saved and purchased itineraries

Who it concerns

Traveller

Data processed

Destination, city, dates, number of travellers, the accommodation and transport selected, the estimated budget and the extras selected. For a purchased itinerary, additionally the payment transaction reference, the amount paid and the time of purchase.

Purpose

Preserving planning in progress so it can be resumed later, and making the purchased itinerary and its expert content available

Legal basis

Performance of a contract — Art. 6(1)(b) GDPR

Retention

Saved itineraries until the account is deleted; data on purchased itineraries for five years from performance, in line with the general limitation period.

g) Sending feedback

Who it concerns

Visitor, Traveller, Expert

Data processed

The message you write and, if you provide them, your name, email address and any screenshot you attach

Purpose

Processing the feedback, fixing bugs, improving the Platform, and replying where needed

Legal basis

Consent — Art. 6(1)(a) GDPR — given by sending the feedback

Processor

Feedback is received through the Sentry error tracking system, which processes the data within the European Union.

Retention

Until the feedback has been processed, and for as long as fixing the reported issue requires

A screenshot may capture everything on your screen. Before sending, please check that it does not contain anything you would rather not share.

h) Sending an enquiry

Who it concerns

Visitor, Traveller

Data processed

Email address, number of travellers, planned dates and the note you write

Purpose

Answering the enquiry and making contact

Legal basis

Steps taken at your request prior to entering into a contract — Art. 6(1)(b) GDPR

Retention

Until the enquiry has been answered and any resulting transaction is concluded

The note field is free text. Please enter only what your enquiry requires, and do not provide data about health, religion, political opinions or other sensitive circumstances.

i) Trip planning and the AI assistant

Who it concerns

Traveller

Data processed

The data entered during planning: travel dates, number of travellers, departure city, accommodation tier, the days selected and removed, programme swaps, and the text of messages sent to the AI assistant

Purpose

Personalising the itinerary, providing suggestions and calculating the final price

Legal basis

Performance of a contract, or steps taken at your request prior to entering into a contract — Art. 6(1)(b) GDPR

About the assistant

The assistant has access to the selected itinerary's days, programmes and tags. It does not have access to the expert tips, to pricing data, or to the personal data you enter in later steps of the booking flow. If you voluntarily include personal data in a message to the assistant, we process it as part of that message.

Automated decision-making

The assistant suggests, it does not decide: every change is approved by you. Section 10 covers this in full.

Processors

We use large language model providers to operate the assistant: Google and OpenAI. Our agreements with them exclude the use of data processed for us to train models. For web searches supporting planning we use Serper.dev, which receives the text of the search query.

International transfer

These providers may also process data in the United States; the safeguards for that transfer are set out in section 9.

Retention

Saved planning data is retained for as long as the account exists, so you can resume planning later; where planning takes place without an account, until the session ends. If a booking is made, the data becomes part of the booking record and the retention period for bookings applies.

Please do not share data with the assistant that planning does not require, such as health data or document numbers.

j) Booking and transmission to the partner travel agency

Who it concerns

Traveller

Data processed

Full name, email address, phone number, language preference, the special requests you provide, travel dates, departure city, destination, the number and composition of travellers, accommodation tier, the final itinerary, the booking reference, the payment confirmation and the booking status

Purpose

Assembling and transmitting the booking to the partner travel agency so that it can conclude and perform the travel contract with you

Legal basis

Performance of a contract — Art. 6(1)(b) GDPR

Recipient

The partner travel agency performing the booking, which becomes an independent controller upon receipt. You receive the Agency's name, contact details and privacy notice during booking and in the booking confirmation.

Retention

Five years from performance, that is from the end of the trip, in line with the general limitation period under the Hungarian Civil Code, on the basis of legitimate interest in potential claims or disputes. Accounting records are retained for eight years.

If not provided

This data is indispensable to performing the booking; without it the booking cannot be carried out.

The special requests field is free text. If you enter data falling within a special category under Article 9 GDPR — a food allergy, reduced mobility or a health condition, for example — we process and transmit it to the Agency solely so that your request can be met. The legal basis is your explicit consent under Art. 9(2)(a) GDPR, given by completing the field and submitting the booking.

k) Fellow travellers and minors

Who it concerns

The Traveller and the fellow travellers they name

Data processed

Fellow travellers' names and the other data the booking requires; for a minor, their age or date of birth

Purpose

Performing the booking for all travellers

Legal basis

Performance of a contract, and the legitimate interest of Bountr and the Agency in performing the booking — Art. 6(1)(b) and (f) GDPR

Retention

Together with the booking data, for five years from performance of the booking

Who provides it

Data on fellow travellers, including minors, is provided by the adult Traveller making the booking. The Traveller warrants that they are entitled to do so: that the fellow travellers have consented or, in the case of a minor, that the Traveller holds parental responsibility or acts with the authorisation of the person who does. The Traveller must inform fellow travellers of this notice.

Age limit

Only persons aged 18 or over with full legal capacity may register and place a booking on the Platform. Minors can of course travel; the booking is placed by an adult. If we learn that a person under 18 has created an account, we will delete it.

l) Payment

Who it concerns

Traveller

Data processed

The fact, amount, currency and time of the payment, the transaction reference and the payment status

What we do not process

Card number, expiry date, security code, bank details. Bountr never sees or stores these.

Purpose

Confirming the booking, tracking that payment has been made, and settlement with the Agency

Legal basis

Performance of a contract — Art. 6(1)(b) GDPR

Retention

As part of the booking record, for five years from performance; accounting records are kept for eight years.

How it works

Payment is handled by Stripe. The amount is credited directly to the partner travel agency's payment account, where the Agency is the merchant of record. Bountr does not collect, process or hold traveller funds. Stripe acts as an independent controller for payment data under its own privacy policy.

m) Invoicing and accounting retention

Who it concerns

Expert, partner agency, and anyone for whom an accounting record is created

Data processed

Name, address, tax identification number or tax number, the amount invoiced or paid, the date of performance, bank account number

Purpose

Meeting statutory obligations: issuing invoices, bookkeeping and tax returns

Legal basis

Legal obligation — Art. 6(1)(c) GDPR — under Section 169(2) of Hungarian Act C of 2000 on Accounting and the Act on the Rules of Taxation

Retention

Eight years from issue of the accounting record. This is a mandatory retention period; we cannot deviate from it and cannot erase this data within that period.

n) Expert data and the expert contract

Who it concerns

Expert

Data processed

Name, home address, place and date of birth, tax identification number, bank account number, email address, phone number, display name, professional bio, portrait photo (if uploaded), and the uploaded itineraries and related materials

Purpose

Concluding and performing the expert contract, paying the licence fee, producing monthly statements, meeting tax and contribution obligations, and publishing the itinerary under the Expert's name

Legal basis

For the data needed to conclude and perform the contract, performance of a contract — Art. 6(1)(b) GDPR. For the tax identification number, home address and birth data, legal obligation — Art. 6(1)(c) — in connection with payer obligations. For the portrait photo and the public professional bio, the Expert's consent — Art. 6(1)(a) — which can be withdrawn at any time.

What is public

The Expert's name or display name, professional bio and, where uploaded, portrait photo appear publicly on the Platform alongside their itinerary. Home address, tax identification number, birth data and bank account number are never public; they are used solely for payment and tax compliance.

Retention

For the duration of the contractual relationship and five years after its termination. Accounting records are kept for eight years. As the licence is granted for the full term of copyright protection, we may retain the Expert's name and the fact of the licence relationship beyond that period, on the basis of legitimate interest, in order to evidence lawful use.

If consent for the portrait photo is withdrawn we remove the photo; this does not affect the licence rights in the itinerary.

o) Quality review of itineraries

Who it concerns

Expert

Data processed

The full content of the submitted itinerary, the Expert's identity, the time of submission, the review outcome and the notes accompanying it

Purpose

Checking whether a submitted itinerary meets the Platform's quality standards before it is published

Legal basis

Performance of a contract — Art. 6(1)(b) GDPR — and Bountr's legitimate interest in maintaining the quality of Platform content — Art. 6(1)(f)

Retention

Five years from termination of the contractual relationship

p) Partner travel agency contacts

Who it concerns

Partner contact

Data processed

Name, job title, business email address, business phone number

Purpose

Maintaining contact under the partnership, handling bookings and settlement

Legal basis

Legitimate interest — Art. 6(1)(f) GDPR — in effective communication with a contractual partner. The impact on the individual is minimal, as we process the data solely in a business capacity using business contact details.

Retention

Five years from the end of the cooperation

q) Complaint handling

Who it concerns

Anyone who submits a complaint

Data processed

Name, contact details, the content of the complaint, the related correspondence and our response

Purpose

Investigating and answering the complaint

Legal basis

Legal obligation — Art. 6(1)(c) GDPR — under Section 17/A of the Hungarian Consumer Protection Act, for consumer complaints

Retention

Five years for the complaint record and a copy of the response, under Section 17/A(7) of the Consumer Protection Act

r) Legal claims

Who it concerns

Anyone involved in a legal claim

Data processed

The existing data relating to the matter

Purpose

Establishment, exercise or defence of legal claims

Legal basis

Legitimate interest — Art. 6(1)(f) GDPR

Retention

Until the claim becomes time-barred or the dispute is finally concluded

Independent controllers

From the moment they receive the data, the parties below act under their own responsibility and their own privacy notice.

• Stripe's privacy notice:stripe.com/privacy
• Google's privacy notice:policies.google.com/privacy

Processors

The following providers process data on our behalf and on our instructions. We have a data processing agreement with each of them.

We do not currently use a newsletter delivery system or invoicing software. When we introduce either, we will update this notice in advance and name the provider. The same applies to any new processor.

In the event of a personal data breach

We act under Articles 33-34 GDPR: we notify the Hungarian National Authority for Data Protection and Freedom of Information within 72 hours of becoming aware, unless the breach is unlikely to result in a risk. Where the breach is likely to result in a high risk to your rights and freedoms, we will also inform you without undue delay.

How we handle your request

We respond within one month of receipt. Where the request is complex, this may be extended by two months, and we will inform you of the extension within one month of receipt. Information and action are free of charge.

Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee or refuse to act; we always give reasons.

Where we have reasonable doubts about the identity of the person making the request, we may ask for further information. This protects your data from being disclosed to someone else.