Privacy policy
Who is responsible for your data on Hurghada House, what we use it for, who receives it (including in Egypt and outside the European Economic Area), how long we keep it and what your rights are.
Effective from: · Document version 1.0
1. Data controller
The controller of your personal data is the real estate office running Hurghada House, based in Egypt: [office company details to be completed].
Office details (data controller)
- Service
- Hurghada House
- Website
- hurghadahouse.pl
Full registration details of the office are also available on request sent to the contact address.
The Office directs its services to people in Poland and other EU countries, so it applies Regulation (EU) 2016/679 (GDPR) to their data, in line with Art. 3(2)(a) GDPR.
2. Contact about your data
For any matter concerning your personal data, write to [office company details to be completed]. We reply without undue delay and within one month at the latest; in complex cases this may be extended by two months, and we will tell you. You can write in Polish or English.
3. Representative in the European Union
The Office is not established in the European Union. EU representative (Art. 27 GDPR): [EU representative details to be completed]
4. Whose data and what data we process
- people sending an enquiry (purchase, long-term rental, owner cooperation, contact): name, e-mail, phone or WhatsApp number, message, the Listing concerned, preferences (budget, district, rental period);
- holiday guests: data from the Booking request (dates, number of guests, pets, notes) and data needed for the stay that you provide after the Confirmation;
- long-term tenants: data in the lease (full name, contact, term, rent, deposit, fees);
- property owners: owner account data (name, e-mail, phone), property data, rental calendar and statements;
- Office staff and associates: panel account data (name, e-mail, role);
- visitors: IP address, browser type, page address and time, in server logs and attack protection.
With every enquiry we also record the consent text you ticked and the time. We do not ask for special category data (e.g. health). If such data reaches us in a message, we delete it.
5. Purposes, legal bases and retention
| Purpose | Legal basis (GDPR) | How long |
|---|---|---|
| Replying to an enquiry about purchase, long-term rental, cooperation or contact | Art. 6(1)(a) (consent ticked in the form) and Art. 6(1)(b) (steps prior to a contract at your request) | until the matter is closed; closed enquiries automatically lose name, e-mail, phone and message 24 months after they were sent; earlier if you withdraw consent or ask for erasure |
| Handling a Booking request and a confirmed booking | Art. 6(1)(b) (contract and pre-contract steps) | the booking and stay, then until limitation periods and the Office's accounting obligations expire |
| Concluding and performing a long-term lease | Art. 6(1)(b) (contract) | the term of the lease, then until limitation periods and the Office's accounting obligations expire |
| Running owner accounts and rental statements | Art. 6(1)(b) (management agreement) | the term of the management agreement and account, then until limitation periods expire |
| Tax and accounting obligations of the Office | Art. 6(1)(c) (legal obligation) | for the period required by the law applicable to the Office |
| Security and spam protection (logs, form rate limits) | Art. 6(1)(f) (legitimate interest: security of the service) | up to 12 months |
| Recording consent (clause text and time) | Art. 6(1)(c) with Art. 7(1) GDPR (accountability) | as long as the enquiry data, and up to 3 years after consent is withdrawn |
| Establishing and defending legal claims | Art. 6(1)(f) | until the limitation period expires |
Providing data is voluntary, but without an e-mail or phone number we cannot reply, and without contract data we cannot conclude a contract.
6. Recipients and processors
We do not sell data. We share it only with providers the Service cannot run without, under data processing agreements (Art. 28 GDPR), and with the persons listed below when your matter requires it:
| Purpose | Provider | Role | Location |
|---|---|---|---|
| Software of the Service and office panel (wiseEstate platform), maintenance and technical support | Softwise | processor | Poland |
| Server: application, database (PostgreSQL), file storage (photos, documents) and account login, all on servers in Germany; deployments via Coolify software on the same server | Hetzner Online GmbH | processor | Germany |
| Content delivery, DNS, attack protection | Cloudflare, Inc. | processor | United States |
| E-mail delivery (enquiry notification to the Office, confirmation to you, account invitations) | Sendinblue SAS (Brevo), with Resend, Inc. as fallback | processor | France / United States |
| AI model: reading developer price lists from PDF and translating Listing descriptions (section 9) | OpenAI (OpenAI Ireland Ltd. / OpenAI, L.L.C.) | processor | Ireland / United States |
| WhatsApp conversation, if you start it | WhatsApp Ireland Ltd. (Meta) | separate controller of the WhatsApp service | Ireland / United States |
| Map on a Listing, only after you click "show map" | OpenStreetMap Foundation | recipient of your IP address | United Kingdom |
Data may also go to the owner of the property you book or rent (to the extent needed for the stay or lease), to the developer or seller you ask about (when you ask us to), to a lawyer or notary in a transaction, to the Office's accountants and to public authorities where the law requires.
7. Transfers to Egypt and outside the European Economic Area
The Office operates in Egypt, so your data leaves the European Economic Area. The European Commission has not adopted an adequacy decision for Egypt.
- Egypt (the Office): Office staff in Egypt read your enquiry, Booking request and lease in order to handle them. The transfer is necessary for the performance of a contract or pre-contract steps you request (Art. 49(1)(b) GDPR). The Office uses the data only for that purpose.
- United States (OpenAI, Cloudflare, Resend): transfers are based on standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR) and, for providers certified under the EU-U.S. Data Privacy Framework, also on the Commission adequacy decision (Art. 45 GDPR).
- United Kingdom (OpenStreetMap): based on the Commission adequacy decision (Art. 45 GDPR).
A copy of the safeguards (e.g. contractual clauses) or information on where they are available can be requested at [office company details to be completed].
8. Security
- encrypted connection (HTTPS) across the Service;
- each office's data separated at database level; staff see only their office's data and owners only their own properties;
- panel accounts by invitation only, with a password set by the user;
- form rate limits and a hidden anti-bot field;
- automatic removal of data from closed enquiries after the retention period.
If a data breach is likely to result in a high risk to you, we will tell you without undue delay, and the supervisory authority within 72 hours (Art. 33-34 GDPR).
9. Artificial intelligence in the Service
In line with the transparency rules of Art. 50 of Regulation (EU) 2024/1689 (AI Act), this is where the Office uses an AI model (provider: OpenAI):
- reading developer price lists and catalogues in PDF: the AI model reads prices, floor areas, payment plans and images from the developer's document and prepares a draft Listing;
- translating Listing descriptions between Polish and English: the AI model prepares a draft translation.
In both cases the result is a draft labelled in the panel as read or translated by an AI model. An Office employee checks every field and only they publish the Listing. Nothing goes live automatically.
The AI model receives developer documents and property descriptions, not your form data. The provider does not use data sent via the API to train its models. There is no AI chat assistant on the Service: enquiries are answered by people.
10. Automated decisions
We do not make decisions about you based solely on automated processing, including profiling (Art. 22 GDPR). Bookings are confirmed or declined by a person.
Only technical steps are automatic: an unconfirmed Provisional booking expires after 48 hours (a lapse of time, not an assessment of you; you can send a new request), forms have rate limits against spam, and prices in another currency are converted at the exchange rate.
11. Your rights
- access and a copy (Art. 15);
- rectification (Art. 16);
- erasure (Art. 17);
- restriction (Art. 18);
- portability of data processed on the basis of consent or contract (Art. 20);
- objection to processing based on legitimate interest (Art. 21);
- withdrawal of consent at any time, without affecting earlier processing (Art. 7(3));
- a complaint to a supervisory authority (section 12).
Send your request to [office company details to be completed]. Exercising your rights is free of charge.
12. Complaint to a supervisory authority
If you live in Poland, you may complain to the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. You may also choose the authority of the EU country where you live, work or where the infringement took place (Art. 77 GDPR); list of authorities: edpb.europa.eu.
14. Changes
We update this policy when processing, the list of providers or the law changes. The effective date and version are shown at the top.