Privacy Policy

1. Who we are

The controller of the personal data described in this policy — the party that decides why and how it is processed — is:

JBF Luxury Villas is the brand under which we present the EM Villas, The One and Virgin Oasis projects. If you would like to reach us about anything in this policy, email is the fastest route.

2. What we process, and why

This is a static, brochure-style website. It has no user accounts, no contact form and no e-commerce. In practice there are only three ways data reaches us or your browser.

a) Server log data

The site is hosted on GitHub Pages. Like any web server, it records technical data when a page is requested: your IP address, the time of the request, the page requested, the referring page and your browser's user-agent string. We do not use these logs to build profiles and we cannot query them for marketing purposes; they exist so the host can keep the service available and defend it against abuse.

• Legal basis: Article 6(1)(f) GDPR — our legitimate interest, and our host's, in operating a secure and available website.
• Retention: determined by our hosting provider; typically a matter of days to a few weeks.

b) Your language choice, stored locally

When you pick HU, EN or RU, the site saves that choice in your browser's local storage under the key jbf_lang. It contains nothing but the two-letter language code, it is never transmitted to us or anyone else, and it is not a cookie. Because it exists solely to deliver the site in the language you asked for, no consent banner is required for it. You can remove it at any time by clearing site data in your browser.

• Legal basis: strictly necessary storage for a service you explicitly requested (Article 5(3) ePrivacy Directive); Article 6(1)(f) GDPR to the extent any personal data is involved.
• Retention: until you clear your browser storage.

c) If you email us

The "Book a call" buttons open your own email client with a pre-filled subject line — nothing is sent until you press send. When you do write to us, we process whatever you choose to include: your name, email address, phone number if you give one, and the content of your message. We use it to answer you and, if a project discussion follows, to prepare and document it.

• Legal basis: Article 6(1)(b) GDPR where your message concerns steps taken at your request prior to a contract; otherwise Article 6(1)(f) — our legitimate interest in responding to enquiries.
• Retention: for the duration of the enquiry and our business relationship, and afterwards only as long as an applicable statutory or contractual retention period requires.

3. What we do not do

• We do not set analytics, advertising or session cookies of any kind.
• We do not run Google Analytics, Meta Pixel, or any comparable measurement or remarketing tool on this site.
• We do not load fonts, scripts or images from third-party CDNs — everything is served from this domain.
• We do not sell, rent or trade personal data, and we do not use it for automated decision-making or profiling.

If we ever add a form, a booking widget or a measurement tool, this policy will be updated first and, where the law requires consent, you will be asked for it before anything is set.

4. Who else is involved

We keep the number of parties involved deliberately small:

We disclose personal data to public authorities only where we are legally obliged to do so.

5. International transfers

Two transfers outside the European Economic Area are inherent in how this site works.

United States. Our hosting provider is US-based. Transfers rely on the EU Standard Contractual Clauses and, where applicable, the provider's certification under the EU–US Data Privacy Framework, together with supplementary technical measures.

Indonesia. As the controller is established in Indonesia, correspondence and project documentation are processed there. Indonesia is not covered by an EU adequacy decision, so these transfers are made under Article 46 or, for individual enquiries you initiate, Article 49(1)(b) GDPR. You may request details of the safeguards in place at the address above.

6. Your rights

Under the GDPR you have the right to:

• Access — obtain confirmation of whether we process your data, and a copy of it.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have your data deleted where no legal ground for keeping it remains.
• Restriction — have processing paused while a dispute over accuracy or lawfulness is resolved.
• Data portability — receive data you provided in a structured, machine-readable format.
• Objection — object at any time to processing based on legitimate interest, including any direct marketing.
• Withdraw consent — where processing rests on consent, withdraw it at any time, without affecting what was lawful beforehand.

Write to info@jbfluxuryvillas.eu and we will respond within one month. There is no charge, unless a request is manifestly unfounded or excessive. We may ask for information to confirm your identity before acting.

7. Complaints

If you believe we have handled your data unlawfully, please tell us first — most issues are quickest to fix directly. You also have the right to lodge a complaint with a supervisory authority, in the EU Member State where you live, work, or where the alleged infringement took place.

In Hungary this is the National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9–11, naih.hu.

8. Security

The site is served over HTTPS. Correspondence and project documents are kept on access-controlled systems, and access is limited to the people who need it to advance your enquiry. No system is perfectly secure, but the small amount of data involved here, and the small number of parties handling it, is itself a meaningful safeguard.

9. Children

This site addresses property investors and is not directed at children. We do not knowingly process the data of anyone under 16. If you believe a child has sent us personal data, contact us and we will delete it.

10. Changes to this policy

We update this policy whenever the site's data practices change. The effective date at the top always reflects the current version. Material changes will be highlighted on this page.