Privacy policy

This is an English translation of the Hungarian privacy policy. In case of any discrepancy, the Hungarian version prevails.

1. Data controller

Name	Highmark Studio Kft.
Registered office	2161 Csomád, Kossuth Lajos út 47.
Tax number	33041236-2-13
Registration number	Cg. 13-09-246888
Representative (managing director)	Égly Csaba
Phone	+36 30 811 6332
E-mail	terepmotorberles@gmail.com
Premises (pick-up)	2113 Erdőkertes, Losonci utca 3.

We are not required to appoint a data protection officer. For data protection questions, contact us at the details above – preferably by e-mail.

2. Legal framework

We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR"), Hungarian Act CXII of 2011 on informational self-determination and freedom of information, and sector-specific laws (e.g. the Accounting Act, the Civil Code).

3. Visiting the website

There is no registration, contact form or newsletter on the website. Fonts are served from our own hosting.

Cookies, analytics and advertising. To measure visits and the effectiveness of our ads, we use the following services via Google Tag Manager – only after your consent, which you can give in the consent manager shown on the website and withdraw there at any time:

• Google Analytics 4 (Google Ireland Ltd.) – visitor statistics (pages viewed, device, approximate location, clicks).
• Google Ads conversion tracking and remarketing (Google Ireland Ltd.) – measuring whether a contact (e.g. a click on the call button) followed an ad click.
• Meta Pixel (Meta Platforms Ireland Ltd.) – measuring and targeting Facebook and Instagram ads.

• Legal basis: consent (GDPR Art. 6(1)(a); Section 155(4) of the Hungarian Electronic Communications Act).
• Retention: provider cookies for up to 13–26 months; Google Analytics data are retained for 14 months.
• Without consent these services are not loaded, or (Google Consent Mode) do not set cookies.

Server logs. For operation and security, the hosting provider automatically logs technical data of visits: IP address, time of visit, URL of the page viewed, browser and operating system type, referring page.

• Purpose: secure operation of the website, preventing abuse (e.g. denial-of-service attacks).
• Legal basis: legitimate interest (GDPR Art. 6(1)(f)).
• Retention: in line with the hosting provider's privacy policy, no longer than necessary for the security purpose.

If we add cookies or third-party services in the future (e.g. a consent manager, Google reviews, maps), they will only be loaded after your consent, and this policy will be updated.

4. Contacting us

You can reach us by phone, e-mail, WhatsApp, Viber, Facebook or Instagram.

• Data processed: name, phone number, e-mail address or social/messaging profile name, content of your message (e.g. requested dates, bike).
• Purpose: answering questions, arranging the rental.
• Legal basis: steps prior to entering into a contract (GDPR Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)).
• Retention: if no rental takes place, up to 1 year from the last contact; in case of a rental, as set out in section 5.

WhatsApp, Facebook and Instagram are services of Meta Platforms Ireland Ltd., Viber is a service of Viber Media S.à r.l.; they process messages under their own privacy policies. For Facebook Page insights we are joint controllers with Meta (GDPR Art. 26).

5. Bike rental

• Data processed: name, place and date of birth, address, ID card number, address card number, driving licence number, category and validity, phone number, e-mail address; rental details (bike, period, pick-up and return times, odometer / engine-hour readings, condition of the bike), deposit details, delivery address if applicable. For the Honda CRF450R, a declaration of off-road riding experience.
• Purpose: concluding and performing the rental agreement, checking eligibility (age, licence), settling the bike and the deposit.
• Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• Retention: 5 years after the end of the contract (limitation period under the Civil Code); accounting records for 8 years.

Copies of documents. With the renter's explicit consent (GDPR Art. 6(1)(a)), copies are made of the documents (ID card, address card, driving licence) to verify identity and riding entitlement. The copies are stored securely and destroyed 3 months after the end of the contract. Consent may be withdrawn at any time before destruction.

Tracking. The bikes are fitted with GPS trackers. Location data are not stored: the tracker is used solely to protect the vehicle, i.e. to locate the bike in case of theft or loss. Legal basis: legitimate interest (GDPR Art. 6(1)(f)).

Damage, accidents, traffic fines. In case of damage or an offence committed during the rental, the renter's data may be forwarded to the insurer or to the authorities (e.g. police, the authority imposing a fine). Legal basis: compliance with a legal obligation (Art. 6(1)(c)) and legitimate interest – enforcing our claims (Art. 6(1)(f)).

6. Invoicing

• Data processed: name, address, (for companies) tax number, service and amount details.
• Legal basis: compliance with a legal obligation (GDPR Art. 6(1)(c); Hungarian VAT Act and Accounting Act).
• Retention: 8 years (Section 169 of the Accounting Act).

7. Processors and recipients

We do not sell personal data or share it with third parties for marketing purposes.

8. Transfers to third countries

Some providers (e.g. Google, Meta) may also process data in the United States. These providers participate in the EU–US Data Privacy Framework or apply the Standard Contractual Clauses adopted by the European Commission.

9. Data security

Personal data are stored in accounts protected by passwords and two-factor authentication, or in a locked place, and are only accessible to those who need them for their tasks. The website is served over an encrypted (HTTPS) connection.

10. Your rights

• access to your personal data (GDPR Art. 15);
• rectification of inaccurate data (Art. 16);
• erasure where there is no longer a legal basis (Art. 17);
• restriction of processing (Art. 18);
• data portability (Art. 20);
• objection to processing based on legitimate interest (Art. 21);
• withdrawal of consent at any time where processing is based on consent.

We respond to requests within one month. Please send your request to the contact details above, preferably by e-mail.

11. Remedies

If you believe your rights have been infringed, please contact us first. You may also lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):

• address: Falk Miksa utca 9–11, 1055 Budapest, Hungary; postal address: 1363 Budapest, Pf. 9.
• phone: +36 1 391 1400; e-mail: ugyfelszolgalat@naih.hu; web: naih.hu

You may also take legal action before the court; you may bring the case before the regional court of your place of residence or stay.

12. Changes to this policy

We update this policy if the law or our processing changes. Effective from: 21 October 2026.