Privacy Notice

1. Controller, contact and roles

For the platform's own account, security, operation and support processing, the controller is Bakos Attila, contact info@fortmes.com. Roles concerning tenant data, rental agreements, financial records and uploaded documents depend on the processing purpose. A landlord or company submitting such information is responsible for the processing it determines; where the Operator processes those records on its behalf, it acts as a processor under the applicable instructions.

2. Individuals and data categories

Individuals may include registered users, company representatives, landlords, tenants, invitees and third parties appearing in invoices or uploaded documents. Data may include names and contact information, verified email, account and contract roles, property and contract details, financial entries, utility and meter identifiers, readings, photos, invoices, documents, inbound-mail metadata, notification preferences, security/audit information, support events and technical logs. Special-category personal data is not intentionally requested.

3. Purposes and legal bases

- Account creation, login, permissions and service delivery: performance of a contract with the data subject where genuinely necessary (Art. 6(1)(b)); a different appropriate basis may be needed for company contacts and other individuals. - Proportionate security, integrity, abuse prevention and audit: legitimate interests (Art. 6(1)(f)), supported by a balancing assessment, or a concrete legal obligation where applicable. - Rental, tenant and financial data: lawful basis determined by the actual controller and its relationship with each data subject. The Operator's processor role, where applicable, does not itself supply a lawful basis to the landlord. - Notifications: a purpose-specific basis for necessary service messages and optional notifications; in-app opt-in settings do not automatically constitute GDPR consent. - Optional cloud AI: separately initiated by the user and assessed under the appropriate purpose-specific legal basis. A user action is not automatically consent under the GDPR. - Data-subject requests and lawful official inquiries: compliance with applicable legal obligations (Art. 6(1)(c)) or another appropriate basis where necessary.

4. Sources

Information may come directly from individuals, inviting contract owners, other authorized contract members, uploaded files, inbound invoice emails, the authentication provider and application-generated security/technical records. Where personal data is not obtained directly from the individual, Article 14 notice obligations and exemptions must be assessed by the relevant controller.

5. Recipients and international transfers

The service providers below process information for authentication, optional AI recognition, email delivery and website delivery. Authorized contract members can access shared records according to their permissions. An EU inference endpoint does not determine the location of all related processing or exclude access from outside the EEA. For questions about recipients and international transfers, contact info@fortmes.com.

Service providers and data processors

Auth0 (Okta) — Authentication and identity

Auth0 provides user authentication and identity management. It processes identity, login and authentication-related information.

Google Cloud Vertex AI — Optional AI processing

Google Cloud Vertex AI processes content explicitly submitted for AI analysis through the available recognition features, including meter photos. AI analysis is optional and is not required for basic authentication or financial functions. The application uses EU inference endpoints; this does not guarantee that every related authentication, support or administrative service processes data only in the EU.

Scaleway Transactional Email (TEM) — Email delivery

Scaleway provides transactional email delivery. It processes the recipient addresses, email content and delivery metadata needed to send service messages.

Bunny.net — CDN and reverse proxy

Bunny.net provides edge delivery, reverse proxy and TLS termination for the website. It processes network traffic and associated connection and request metadata. HTTPS termination involves processing traffic even when application content is not cached.

6. Retention and erasure

Meter photos and invoice records belong to rental contracts and are protected by contract permissions. Deleting an account does not automatically erase shared records needed by other authorized parties. Private files, mail history, support audit records and backups have separate deletion and retention processes. Access, correction and erasure requests can be sent to info@fortmes.com; their assessment takes account of applicable obligations and other individuals' rights.

7. Security and support access

The Service uses contract-based access permissions, private file access and security audit controls. Separately authorized customer support access requires recent multi-factor authentication, a documented reason and audit logging. It is read-only and lasts at most 15 minutes. Affected users can review their own support history and revoke active access.

8. Individual rights

Individuals may request information, access, rectification, erasure where applicable, restriction, portability where applicable, and may object to processing based on legitimate interests. Where processing actually relies on consent, it may be withdrawn without affecting prior lawful processing. Contact info@fortmes.com. Responses are generally provided within one month, subject to lawful extension and timely notice. Proportionate identity verification may be requested. Rights of others and lawful retention obligations may limit a request.

9. Complaints and authorities

Individuals may lodge a complaint with a competent data protection supervisory authority, in particular in their habitual residence, place of work or place of alleged infringement. In Hungary, the authority is the NAIH. Judicial remedies remain available.

10. Cookies and automated decisions

Login, session security and preference technologies are described in the Cookies and Technologies notice. The application does not add optional analytics or marketing tracking. AI recognition provides suggestions for user review and does not make solely automated decisions producing legal or similarly significant effects.