PRIVACY POLICY
Brik – real estate investment decision-support service
Version: v4.10 · Effective: from 6 November 2026 until withdrawn or amended
1. DATA CONTROLLER DETAILS
| Name of data controller | Nguyen Nam Tuan sole proprietor |
| Registered office | 1134 Budapest, Lőportár utca 20/A |
| Registration number | 59517986 |
| Tax number | 90335040-1-41 |
| info@brik.hu | |
| Website | https://brik.hu |
In this Privacy Policy, the Data Controller (hereinafter: Brik or Data Controller) informs Users about how their personal data is processed, the legal bases, purposes and duration of processing, and the rights of data subjects.
Data Protection Officer (DPO): Under GDPR Article 37, the Data Controller's activities do not require the appointment of a data protection officer. For data protection matters, contact info@brik.hu.
2. APPLICABLE LEGISLATION
This Privacy Policy is based on the provisions of the following legislation:
- GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data;
- Infotv. (2011. évi CXII. törvény – Hungarian Info Act 2011/CXII): on the right of informational self-determination and freedom of information;
- Eker. tv. (2001. évi CVIII. törvény – Hungarian E-Commerce Act 2001/CVIII): on certain questions relating to electronic commerce services;
- Grtv. (2008. évi XLVIII. törvény – Hungarian Advertising Act 2008/XLVIII): on the basic conditions of commercial advertising activities;
- Sztv. (2000. évi C. törvény – Hungarian Accounting Act 2000/C): on accounting;
- Eht. (2003. évi C. törvény – Act C of 2003 on electronic communications): on electronic communications;
- Ptk. (2013. évi V. törvény – Hungarian Civil Code 2013/V): on the Civil Code.
3. PRINCIPLES OF DATA PROCESSING
When processing personal data, Brik observes the following principles (GDPR Article 5):
- Lawfulness, fairness, transparency: processing always rests on a specific legal basis and is communicated transparently.
- Purpose limitation: we process data only for expressly specified, lawful purposes.
- Data minimisation: we request and process only the minimum data necessary.
- Accuracy: we strive to store accurate and up-to-date data; we correct data upon User request.
- Storage limitation: we retain data only for as long as necessary.
- Integrity and confidentiality: we protect data with appropriate security measures.
- Accountability: we document all our data processing activities.
4. PURPOSES, LEGAL BASES AND DATA PROCESSED
Brik processes personal data for the following purposes:
4.0. Unregistered visitors – calculator input form
| Purpose | Displaying the calculator input form; temporarily preserving entered data for return after registration |
| Legal basis | Legitimate interest – GDPR Article 6(1)(f) |
| Data processed | Session identifier (session cookie), IP address, browser type, timestamp. Property data entered in the calculator (purchase price, rent, loan parameters, expected appreciation) is stored only for the session on the User's device (sessionStorage) – no calculation runs without registration. |
| Retention period | Individual calculator data is processed only for the duration of the session on the User's device – deleted when the browser is closed; it is NOT stored on the server in individual or personally linkable form |
| Third parties | Individual data is not transferred to third parties (see Section 4.10 on anonymous aggregated statistics) |
Unregistered visitors can see the calculator input form, but cannot run a calculation. Any data they enter remains only on their device at session level (e.g. so that after registration the calculation can run with the same inputs). Brik servers do NOT permanently store this individual data and do NOT link it to a person. Anonymous, aggregated market statistics are compiled only from calculations by signed-in users – see Section 4.10. A free registration is required to use the calculator.
4.1. Registration and account management
| Purpose | Enabling use of the Brik service, creating a user account, login |
| Legal basis | Contract performance – GDPR Article 6(1)(b) |
| Data processed | E-mail address; for email/password registration: password (bcrypt hashed), name (optional); for Google sign-in: Google LLC (auth data processor) shares data required for login (e-mail, name) with Brik – Brik uses this to create the account and authenticate; registration date; IP address |
| Retention period | For the duration of the account + 30 days from account deletion (for recovery), then immediate deletion |
4.2. Brik Pro subscription and payment
| Purpose | Managing the Brik Pro subscription, fee debits, maintaining subscription status |
| Legal basis | Contract performance – GDPR Article 6(1)(b) |
| Data processed | Stripe Customer ID, subscription status, subscription start and expiry, payment method metadata (last 4 digits, card type), transaction ID. We do NOT process full bank card data; those are stored exclusively by Stripe under PCI DSS Level 1 compliance. |
| Retention period | For the duration of the subscription + 8 years (accounting obligation, Sztv. Section 169) |
4.3. Invoicing
| Purpose | Issuing invoices, NAV Online Invoice data reporting, accounting compliance |
| Legal basis | Legal obligation – GDPR Article 6(1)(c) and Sztv. Section 169 |
| Data processed | Invoice data: full name, billing address (country, postal code, city, street/house number), e-mail address, tax number (only for corporate customers if provided), invoiced amount, date of performance |
| Retention period | 8 years from the end of the calendar year (Sztv. Section 169(1)) |
How data is collected: The User provides billing data on the Stripe Checkout payment interface. The data is stored and processed by Stripe Payments Europe Limited, then transferred to Brik's invoicing system (Billingo) via Stripe's webhook mechanism. Brik processes this data solely for invoice issuance to fulfil legal obligations.
4.4. User calculations
| Purpose | Saving, retrieving and comparing real estate investment calculations performed by the User |
| Legal basis | Contract performance – GDPR Article 6(1)(b) |
| Data processed | Property data (address, purchase price, transfer tax, other purchase costs, rent, monthly common charges, monthly utilities, loan parameters, etc.) linked to the user's account. Property data is not personal data in itself, but is linked to the User ID. |
| Retention period | For the duration of the account + immediate deletion upon account deletion |
Use of Market Reference Data
The Brik calculator compares the property data you provide with publicly available market reference data. This reference data comes from the following sources:
- ÁKK (Hungarian Government Debt Management Agency) – government bond yields
- BAMOSZ (Association of Hungarian Investment Fund and Asset Managers) – average returns of investment funds
- BÉT (Budapest Stock Exchange) – BUX index data
- S&P Global – S&P 500 index historical data
- MSCI – MSCI World index historical data
- KSH STADAT – housing market price statistics (location-based reference data)
The calculator may also display location-based market reference data (average price per m², rent, and 5-year appreciation trend for a selected district or city). This data also comes from public sources and is not personal data.
This data does not contain personal information and is used solely for informational comparison purposes. The comparison does not constitute investment advice.
The number of reference rows shown in the investment comparison table depends on the User's registration and subscription status; this does not involve any new processing of personal data and only limits what is displayed.
Data is updated manually on a monthly basis. Appreciation and past returns are estimates and do not guarantee future results. The comparison table's "This property" row shows total expected return (rental yield + estimated appreciation).
4.5. Customer relations and technical support
| Purpose | Answering User questions, handling complaints, providing technical assistance |
| Legal basis | Contract performance or legitimate interest – GDPR Article 6(1)(b) or (f) |
| Data processed | E-mail content, attached files, response timestamp, contact identifier |
| Retention period | 5 years following contact (Ptk. Section 6:22 limitation period) |
4.6. Newsletter and marketing (only with consent)
| Purpose | Sending newsletters, product news, promotions and relevant content via Klaviyo, Inc. |
| Legal basis | Consent – GDPR Article 6(1)(a) and Grtv. Section 6(1) |
| Data processed | E-mail address, name, registration date, opt-in IP address, opt-in timestamp, unsubscribe date, e-mail opens / clicks (engagement) |
| Retention period | Until unsubscribe + 5 years (for proof under Grtv. Section 6(5)); unsubscribed data remains on a "suppression list" as e-mail hash to prevent re-contact |
Newsletter subscription may be withdrawn at any time, free of charge by clicking the "Unsubscribe" link in the newsletter or by e-mail to info@brik.hu.
4.7. Fraud prevention and security logs
| Purpose | Maintaining service security, preventing abuse, monitoring failed login attempts |
| Legal basis | Legitimate interest – GDPR Article 6(1)(f) |
| Data processed | Login logs (IP address, browser, timestamp), failed authentication attempts |
| Retention period | 90 days, except where longer retention is justified by active security incident investigation |
4.8. Cookies
Detailed information on cookie use is available in the Cookie Policy.
| Legal basis (strictly necessary cookies) | Contract performance / legitimate interest – GDPR Article 6(1)(b)/(f), Eht. Section 155(4) |
| Legal basis (analytics, marketing cookies) | Consent – GDPR Article 6(1)(a), Eht. Section 155(4) |
4.9. Website traffic (Vercel Web Analytics – consent only)
| Purpose | Measuring anonymised, aggregated traffic on the Brik website (which pages are visited, where visitors come from, device type) to improve the service |
| Legal basis | Consent – GDPR Article 6(1)(a) |
| Data processor | Vercel, Inc. (see Section 5.1) |
| Data processed | Page views (URL), referrer, event timestamp, approximate geographic location (country/region), device OS and type (mobile/desktop/tablet), browser type – in anonymised, aggregated form; we do not process name, email, account ID, or IP address as persistent identifiers |
| Cookies | Vercel Web Analytics does not set analytics cookies |
| Visitor identification | Daily anonymous hash from the request; the hash is automatically discarded after 24 hours (Vercel documentation) |
| Retention | Visitor session hash: up to 24 hours. Aggregated statistics in the Vercel dashboard are available per Vercel’s reporting window (Hobby plan: 1 month; Pro plan: 12 months; details: https://vercel.com/docs/analytics/limits-and-pricing) |
| Activation | Only after the User gives analytics consent via the cookie banner |
Vercel privacy policy: https://vercel.com/legal/privacy-policy. Technical details: https://vercel.com/docs/analytics/privacy-policy
4.10. Anonymous, aggregated market statistics
| Purpose | Producing anonymous, aggregated statistics on market interest during calculator use for service improvement and market analysis |
| Legal basis | Legitimate interest – GDPR Article 6(1)(f). As the data is anonymous, it does not constitute personal data under the GDPR. |
| Data processed | Aggregated, bucketed data. Investment calculator: location (city/district), price band, rent band, yield band, loan flag, positive/negative monthly cash flow flag, and – each counted separately – price-per-m² band, rent-per-m² band, floor-area band, expected appreciation band, interest-rate band, loan-to-price band, tax mode, who pays the common charges, planned holding-period band. Wekerle Plusz calculator: property type and condition (new/used), price, price-per-m², floor-area, down-payment-ratio and monthly-instalment bands, eligibility (yes/no) and the type of unmet condition (without age, location or exact values). For both: month. Dimensions are not combined with each other, and only aggregates containing at least 10 calculations may be shared with third parties. Not stored: name, email, IP address, user identifier, individually identifiable record, exact values (e.g. specific purchase price or exact cash flow amount) – only value bands and categories (yes/no). |
| Retention period | Monthly breakdown, for as long as the statistics remain relevant for their purpose |
| Third parties | Brik may in the future share or sell these aggregated, anonymous statistics to third parties (e.g. real estate market or financial market participants) solely in aggregated, anonymous form |
During calculator use, Brik compiles anonymous, aggregated statistics on market interest (e.g. which cities/districts, price and rent bands, expected yield bands, loan or Otthon Start usage, and whether the calculated monthly cash flow is positive or negative). This data is stored exclusively in aggregated, bucketed form and does not contain any personal data: no name, email, IP address, or individually identifiable record. Exact values (e.g. a specific purchase price) are not stored – only value bands. No individual user can be identified from this data.
The legal basis for processing is Brik's legitimate interest [GDPR Article 6(1)(f)] in improving the service and conducting market analysis. As the data is anonymous, it does not constitute personal data under the GDPR.
Brik may in the future share or sell these aggregated, anonymous statistics to third parties (e.g. real estate market or financial market participants) solely in aggregated, anonymous form.
Cookies: Anonymous market statistics do not use cookies and do not require cookie-banner consent; processing is based on the legitimate interest described above.
4.11. Sign-up source (how you heard about Brik)
| Purpose | Measuring which channel (e.g. TikTok, Instagram, Facebook, Google, a friend) registered Users heard about Brik from – to evaluate and improve marketing |
| Data – self-reported | The answer to "How did you hear about Brik?" (one of the predefined categories or "I'd rather not say") and the time of the answer. Answering is voluntary and the question can be closed |
| Data – campaign source | Campaign parameters in the link of the first visit (utm_source, utm_medium, utm_campaign), the referring site's domain (e.g. instagram.com) and the time of capture. Brik stores these in the browser (brik-attribution, localStorage) only with analytics consent and links them to the account once, after sign-in |
| Legal basis | Self-reported answer: legitimate interest – GDPR Article 6(1)(f) (voluntary, can be deleted at any time). Campaign source: consent – GDPR Article 6(1)(a) |
| Retention | Until the account is deleted. After consent is withdrawn, no new campaign-source data is captured and the value stored in the browser is deleted |
| Processor | Supabase, Inc. (see Section 5.2) |
| Third parties | Not shared with third parties; Brik only uses it in aggregated form (e.g. "40% of this week's sign-ups came from TikTok") |
5. DATA PROCESSORS – WHO HAS ACCESS TO THE DATA?
To operate the Service, Brik uses the services of the following third parties (data processors). A valid Data Processing Agreement (DPA) is in place with every data processor.
5.1. Vercel, Inc. (frontend hosting and web analytics)
| Registered office | 440 N Barranca Avenue #4133, Covina, CA 91723, USA |
| Data storage location | EU region: Frankfurt (Germany) |
| Activity | Serving the Brik website and web application; Vercel Web Analytics anonymised traffic measurement (consent only, see Section 4.9) |
| Data processed | Hosting: IP address, browser data, request logs. Analytics (opt-in): page views, referrer, approximate region, device and browser type (anonymised, aggregated) |
| Transfer mechanism | EU-USA Data Privacy Framework (DPF) – certified participant (since 04.06.2024), and EU Standard Contractual Clauses (SCC) |
| More information | https://vercel.com/legal/privacy-policy |
5.2. Supabase, Inc. (database and authentication)
| Registered office (legal entity) | Supabase, Inc., Delaware, USA |
| Data storage location | EU region: eu-west-1 (Ireland, AWS) |
| Activity | Storing user accounts, password hashes, calculations and other data in PostgreSQL, authentication |
| Data processed | User account data, calculations, session data |
| Transfer mechanism | EU Standard Contractual Clauses (SCC) Module 2 + UK ICO Addendum (DPA: 14.03.2025) – Supabase is NOT a DPF member |
| Note | Although data is physically stored in the EU (Ireland), Supabase, Inc. is a US legal entity, so the CLOUD Act may theoretically apply. Brik therefore stores data alongside the Transfer Impact Assessment (TIA) provided by Supabase. |
| More information | https://supabase.com/legal/dpa |
5.3. Stripe Payments Europe, Limited (payment)
| Registered office | The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland |
| Data storage location | EU |
| Activity | Processing card payments, recurring (subscription) debits, Stripe Customer Portal |
| Data processed | Bank card data (Brik does NOT have access), transactions, Customer ID, payment method metadata |
| Transfer mechanism | Within the EU; where necessary, under EU SCC |
| Note | Stripe also acts as an independent data controller towards Brik (due to its own AML, fraud prevention and PSD2 obligations). |
| More information | https://stripe.com/legal/privacy-center |
5.4. Billingo Zrt. (invoicing)
| Operator | Octonull Korlátolt Felelősségű Társaság |
| Registered office | 1133 Budapest, Árbóc utca 6. |
| Tax number | 23153268-2-41 |
| Data storage location | Hungary (European Union) |
| Activity | Electronic invoice issuance, NAV Online Invoice data reporting, invoice archiving |
| Data processed | Invoice data: name, address, tax number (for companies), e-mail, invoiced amount |
| Transfer mechanism | EU-internal processing, GDPR-based |
| Transfer to NAV | Billingo reports data to the NAV Online Invoice system on Brik's behalf under legal obligation (Áfa tv.) |
| More information | https://www.billingo.hu/adatkezelesi-tajekoztato |
5.5. Zoho Corporation B.V. (e-mail hosting – info@brik.hu)
| Registered office | Beneluxlaan 4B, 3527 HT Utrecht, Netherlands |
| Data storage location | EU region: Amsterdam (Netherlands) and Dublin (Ireland) – zoho.eu data centres |
| Activity | Sending and receiving e-mail from Brik @brik.hu addresses |
| Data processed | E-mail content, attachments, sender/recipient data |
| Transfer mechanism | Primarily within the EU; under certain circumstances (technical support) Indian access is possible, under EU Standard Contractual Clauses |
| Note | Zoho is NOT a DPF member; cross-border transfer occurs exclusively under SCC. |
| More information | https://www.zoho.com/privacy.html |
5.6. Klaviyo, Inc. (marketing e-mail – only with consent)
| Registered office | 125 Summer St, Floor 6, Boston, MA 02110, USA |
| Data storage location | USA (AWS) |
| Activity | Sending marketing newsletters and automated e-mail campaigns – only with the User's explicit consent |
| Data processed | E-mail address, name, opt-in IP, opt-in timestamp, e-mail engagement |
| Transfer mechanism | EU-USA Data Privacy Framework (DPF) – active certified participant (#6149), plus UK Extension and Swiss-US DPF |
| More information | https://www.klaviyo.com/legal/privacy-policy |
5.7. Summary table of data processors
| Data processor | Role | Data location | Mechanism |
|---|---|---|---|
| Vercel, Inc. | Frontend hosting + Web Analytics (opt-in) | Frankfurt, EU | DPF + SCC |
| Supabase, Inc. | Database, auth | Ireland, EU | SCC + UK Addendum |
| Stripe Payments Europe | Payment | EU | EU-internal + SCC |
| Billingo / Octonull Kft. | Invoicing | Hungary | GDPR (EU) |
| Zoho Corporation B.V. | E-mail hosting | Netherlands + Ireland | EU-internal + SCC |
| Klaviyo, Inc. | Marketing e-mail (opt-in) | USA | DPF + SCC |
6. TRANSFER OF DATA TO THIRD COUNTRIES
Some of the data processors listed in Section 5 are US-based (Vercel, Supabase, Klaviyo). Transfers to them are based on one of the following mechanisms:
-
EU-USA Data Privacy Framework (DPF) – Vercel and Klaviyo are active members; provides adequate protection under the European Commission adequacy decision (2023/1795/EU).
-
Standard Contractual Clauses (SCC) – applicable to Supabase and Zoho; contractual safeguards under European Commission Implementing Decision 2021/914/EU.
-
UK ICO Addendum – where data also flows through the United Kingdom.
Brik relies on the latest information on the official pages of data processors regarding transfer mechanisms, and will promptly amend its data processing practices if necessary – e.g. in case of legal changes (such as invalidation of the DPF).
7. RIGHTS OF DATA SUBJECTS
The User has the following rights in relation to data processing under GDPR Chapter III:
7.1. Right of access (GDPR Article 15)
The User may request that Brik inform them about what personal data it processes, for what purpose, from what source, how long it stores it, and to whom it transfers it.
7.2. Right to rectification (GDPR Article 16)
The User may request that Brik rectify inaccurate personal data concerning them and complete incomplete data.
7.3. Right to erasure / "right to be forgotten" (GDPR Article 17)
The User may request erasure of their personal data. We are obliged to fulfil erasure requests, except where:
- a legal obligation (e.g. Sztv. Section 169 – 8-year invoice retention) would conflict,
- it is necessary for establishing, exercising or defending legal claims,
- freedom of expression and information justifies retention.
7.4. Right to restriction of processing (GDPR Article 18)
The User may request restriction of processing if they contest the accuracy of data, or if processing is unlawful but they do not request erasure.
7.5. Data portability (GDPR Article 20)
The User may request that data processed on the basis of consent or contract in automated form be provided in a structured, commonly used, machine-readable format (e.g. JSON, CSV), or transferred to another controller.
7.6. Right to object (GDPR Article 21)
The User may object to processing based on legitimate interest, and at any time, without giving reasons to processing for direct marketing purposes.
7.7. Rights related to automated decision-making (GDPR Article 22)
Brik does not make decisions based solely on automated processing concerning the User. Brik's calculator is a decision-support tool: the final decision is always made by the User.
7.8. Withdrawal of consent
If processing is based on consent (e.g. newsletter, marketing cookies), the User may withdraw consent at any time, free of charge at info@brik.hu or via the appropriate interface (cookie banner, newsletter unsubscribe link).
Withdrawal of consent does not affect the lawfulness of consent-based processing carried out before withdrawal.
7.9. How can these rights be exercised?
The User may exercise their rights as follows:
- E-mail: info@brik.hu
- Postal address: 1134 Budapest, Lőportár utca 20/A
Brik will respond in writing to requests received within 1 month at the latest. For complex or numerous requests, this period may be extended by a further 2 months, of which Brik will inform the User within 1 month of the request.
Brik fulfils requests free of charge, except for unfounded or excessive requests (e.g. repeated identical requests).
8. DATA SECURITY MEASURES
To protect data, Brik applies the following measures (GDPR Article 32):
Technical measures:
- HTTPS / TLS 1.3 encryption for all data transmission;
- bcrypt password hashing for user passwords (via Supabase Auth);
- Row-Level Security (RLS) in the Supabase database, ensuring each User can access only their own data;
- regular security updates for dependencies (automatic via Vercel, Supabase);
- daily automatic backups (Supabase);
- multi-factor authentication (MFA) for administrative access;
- PCI DSS Level 1 compliance by Stripe for payment data.
Organisational measures:
- data breach handling procedure (see Section 9);
- "least privilege" principle: only strictly necessary access is granted;
- data processor agreements (DPA) with every data processor;
- regular review of data processing practices.
9. DATA PROTECTION INCIDENT
A data protection incident is an event under GDPR Article 4(12) resulting in accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, personal data transmitted, stored or otherwise processed.
Notification obligation:
- In case of a data protection incident, Brik must report it to NAIH within 72 hours of becoming aware (GDPR Article 33).
- If the incident poses high risk to User rights, Brik will also directly notify affected Users (GDPR Article 34).
Brik records incidents in its incident register, containing the nature of the incident, scope of affected persons, likely consequences and remedial measures.
10. CHILDREN'S DATA
The Brik service may be used by natural persons who have reached the age of 16 (Infotv. and GDPR Article 8).
During registration, the User expressly declares that they have reached the age of 16. If Brik becomes aware that a User has not reached the age of 16, Brik will immediately delete the affected personal data.
11. AUTOMATED DECISION-MAKING, PROFILING
Brik does not apply automated decision-making or profiling that produces legal effects concerning the User or similarly significantly affects them (GDPR Article 22).
Brik's calculation models (total return, cap rate, cash flow, investment score, etc.) are decision-support tools and do not replace the User's own decision.
12. AMENDMENTS TO THIS PRIVACY POLICY
Brik reserves the right to unilaterally amend this Privacy Policy if legal changes, introduction of new features or other justified circumstances make this necessary.
Brik will notify Users of amendments at least 15 days before they take effect at the registered e-mail address or on the Service interface. The amended Privacy Policy is effective from the date it takes effect.
13. REMEDIES, SUPERVISORY AUTHORITY
13.1. Remedies with Brik
For data protection questions, complaints or requests, the User should first contact Brik's data protection contact:
- E-mail: info@brik.hu
- Postal address: 1134 Budapest, Lőportár utca 20/A
Brik will respond in writing within a maximum of 30 days of receipt.
13.2. Right to contact the supervisory authority
The User may lodge a complaint directly with the Hungarian data protection supervisory authority, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) (Hungarian Data Protection Authority):
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) (Hungarian Data Protection Authority) Address: 1055 Budapest, Falk Miksa utca 9-11. Postal address: 1363 Budapest, Pf. 9. Phone: +36 (1) 391-1400 Fax: +36 (1) 391-1410 E-mail: ugyfelszolgalat@naih.hu Web: https://www.naih.hu
13.3. Judicial remedy
The User may also enforce their claims regarding data processing before a court. The court with jurisdiction – at the User's choice – is the tribunal at the User's place of residence or stay.
14. FINAL PROVISIONS
This Privacy Policy shall be interpreted under Hungarian law. In disputed matters, Hungarian courts have jurisdiction.
For matters not regulated in this Policy, the provisions of the GDPR, Infotv. and applicable Hungarian legislation shall apply.
This Privacy Policy is continuously available and downloadable at /privacy.
Prepared: 8 June 2026.