PlanWalkVR – Privacy Notice

1. Controller details and contact information

1.1. Controller: AiPlanLab Korlátolt Felelősségű Társaság, abbreviated as AiPlanLab Kft., a Hungarian limited liability company (the Service Provider). Registered office and correspondence address: 2119 Pécel, Termál utca 27., Hungary.

1.2. Company registration number: 13-09-239907. Hungarian tax number: 32792661-2-13. EU VAT number: HU32792661. Website: https://planwalkvr.com; application: https://planwalkvr.com/app/.

1.3. Data protection enquiries and requests: info@aiplanlab.com. Telephone: +36 70 370 7446. When making a request, please identify your account email address, the relevant project and the action you are requesting. Do not send your password or confidential access credentials.

1.4. This Notice is based in particular on Regulation (EU) 2016/679 (GDPR), Hungarian Act CXII of 2011, Act C of 2000 on Accounting, Act CLV of 1997 on Consumer Protection and Hungarian legislation governing electronic processing of personal data. The following sections describe the legal bases for each purpose.

2. Controller and processor roles

2.1. The Service Provider acts as an independent controller for user accounts, contractual communications, its own billing, service security, its own customer support and operational records. The details of an individual acting as a business customer's contact person are also personal data.

2.2. Where an organisation, sole trader or other customer uploads project materials concerning its employees, construction participants or other individuals for its own purposes, the customer generally determines the purposes of processing that content. For this processing, the customer is the controller and the Service Provider acts as a processor on the customer's documented instructions. A separate agreement under Article 28 GDPR governs that processing; this Notice does not replace that agreement.

2.3. The customer is responsible for ensuring an appropriate legal basis for its own processing of project data, informing data subjects and managing the access rights it grants. The contract between the Service Provider and the customer does not automatically provide a legal basis for processing data about an employee or passer-by appearing in a photograph. Additional rules on personality rights and employment may apply to images of individuals, residential interiors and employee data.

2.4. If you appear in a customer's project but are not a user of the service, you may address your data protection request primarily to the customer responsible for the project. If you contact us directly, we will assist with resolving the request or forward it to the relevant controller. This does not restrict your right to seek a remedy before a supervisory authority or court.

2.5. Only authorised users may access project materials. The Service Provider does not automatically make project materials public. A service administrator may access the necessary data for a justified support, security or operational task; access to customer content must also comply with the applicable processing instructions.

3. Account and workspace management

3.1. During registration, login and account management, we process your name, email address, a one-way hash of your password, internal user ID, language preference, registration and email verification times, account status, and workspace and project memberships and permissions. We do not store passwords in plain text. Contractual records include the unchanged content, version and language of the accepted Terms and Conditions, the time of acceptance and identity of the person accepting them, related contractual declarations, and the content and sending details of the confirmation. These records also include an express request for early performance and the related consumer declaration, where such declarations are made.

3.2. Workspace data includes its name and type, identification of the owner and members, the project structure, the start and end of the free trial or access period, service allowances, credit balance and records of changes to allowances. When a coupon is redeemed, we also record the coupon ID, redemption time, relevant workspace and allowance granted.

3.3. The purposes of processing are to conclude the contract, record its content and acceptance, provide confirmation and access, manage team members' permissions and account for service allowances. If you are the contracting party as an individual, processing necessary to conclude and perform the contract is based on Article 6(1)(b) GDPR. For organisational contact persons and invited colleagues, the basis is Article 6(1)(f): the Service Provider's and the customer's legitimate interests in administering the contract and identifying authorised participants. Providing information and confirmation required by law is based on Article 6(1)(c), in particular under Hungarian Act CVIII of 2001 on Electronic Commerce Services and, for consumer contracts, Government Decree 45/2014 (II. 26.). Retention of contractual evidence for legal claims is governed by Section 6.9.

3.4. The registration process may request a billing name, country, postcode, town or city and address, and a tax number for business registrations. These fields prepare for subsequent purchases and invoicing; the free trial does not, in itself, create a statutory obligation to collect all billing details.

3.5. We cannot provide an account without the information needed for login; without the necessary membership, the relevant project cannot be accessed. A purchase cannot be completed without billing information required by law. Not providing additional data for optional features does not prevent use of unrelated services.

3.6. We use time-limited, purpose-specific links for password resets, email verification and invitations; the server processes a hash of the authentication token. Do not share such links or the emails containing them. Expiry of a link ends its usability; it does not mean that all related records are immediately deleted.

3.7. Optional Sign in with Google. You may use your Google Account alongside the email and password registration and login options. Starting Google sign-in redirects you to Google’s own sign-in page. We receive a persistent account identifier (sub), your email address and its verification status from Google. The application requests only the openid and email permissions; it does not request your Google password, profile picture, contacts, calendar, Gmail messages or Google Drive files. You provide the remaining registration details in PlanWalkVR.

3.8. Use of Google data. We use the identifier to locate the appropriate PlanWalkVR account and authenticate login, and the verified email address to prepare registration and communicate about the account and service. We store the Google account link together with the internal user ID, linked email address and creation time. We do not automatically link accounts based on a matching email address: linking an existing account requires a separate user action and the PlanWalkVR password.

3.9. Purpose and legal basis. Optional Google sign-in enables creation, secure identification and access to the account you request. For a user contracting as an individual, necessary processing is based on Article 6(1)(b) GDPR; for an organisational contact person or invited colleague, it is based on the legitimate interest described in Section 3.3. Necessary security logging is governed by Section 5.8. Technical permission granted on Google’s interface is not general consent to all PlanWalkVR processing. Password-based login remains available without a Google Account.

3.10. Retention and protection. We retain the link between your Google and PlanWalkVR accounts until it is disconnected or the account is deleted; account deletion and exceptions are governed by Section 6. We use the access token received during the code exchange only for that authentication, do not save it in a database and do not maintain a Google refresh token. Preparatory session data for an unfinished Google registration may be used to continue registration for up to 30 minutes; this is a validity limit, not a promise of immediate physical deletion of all technical session data. We retrieve Google data over encrypted network connections and protect stored account data through access controls. Security logs and separate backups follow the retention rules in Sections 6.7 and 6.11.

3.11. Disconnecting and requesting erasure. You may disconnect Google under My account → Profile and security by verifying a working local password. If you registered only with Google, first use Forgot password to set a PlanWalkVR password. Disconnecting deletes the active Google account association, but does not by itself delete your PlanWalkVR account, its email address or projects. Access granted on Google’s side can be managed separately at https://myaccount.google.com/connections; revoking it does not automatically delete your PlanWalkVR account. You may request erasure of your personal data at info@aiplanlab.com as described in Section 11.

3.12. Access and disclosure. Authorised operators and the hosting provider described in Section 7 may access Google account data to the extent needed for their tasks. As the account contact address, the email address may also be used for service communications and related administration, with the recipients and retention periods described in Sections 5–7. We do not disclose the Google account identifier for billing or AI analysis. We do not sell data received through Google sign-in, use it to create advertising profiles or use it to train AI models. Google sign-in does not grant Google access to PlanWalkVR projects, photographs, documents or AI conversations.

4. Project materials and AI features

4.1. Data processed within a project may include building, floor, room and photo point names, information about the project or construction location, images, panoramic images, floor plans, documents, comments, capture or upload dates and identification of the uploader. Technical data includes the original filename, size, type, image dimensions, storage ID, previews, thumbnails, version and deletion status. This information is personal data where it can be linked to an individual.

4.2. Photographs may contain people, vehicle registration numbers, personal documents, residential interiors or other identifying details. Original files may also contain metadata about location or the device used; do not assume before uploading that the application automatically removes all such data. Obscure unnecessary personal details and upload only material needed for the documentation purpose.

4.3. The service is not a system for health records, biometric identification or criminal records. Do not upload special categories of personal data or data relating to criminal convictions and offences without conditions specifically governing that processing having been clarified in advance. Data protection also applies to personal data appearing incidentally in an image; we do not treat an image of a face as data used for biometric identification merely because a face appears in it.

4.4. For AI image analysis, the question, selected images or processed versions or sections of them, and project and room data needed for interpretation may be sent to the OpenAI API. Project-based queries may also transmit image descriptions used for retrieval, filters, previous conversation excerpts and, where necessary, a floor plan reference. Not all AI operations use the same categories of data.

4.5. Where the image catalogue and the inspection features built on it are enabled, AI processing of images may also start as a background task after upload; transmission does not necessarily require a separate chat question. AI processing serves to organise and compare documentation and produce the analysis requested by the user.

4.6. Where you use an AI service in your own capacity as an individual, the necessary processing is based on Article 6(1)(b) GDPR. For project data about third parties for which the customer is the controller, the Service Provider acts as the customer's processor; the customer must ensure a legal basis concerning those individuals. Starting an AI feature does not replace appropriate information to, or any necessary permission from, the person appearing in the image.

4.7. Under the OpenAI API data protection terms, content sent through the API is not used for model training by default. This does not mean that no data is retained: security and abuse monitoring logs are generally retained for up to 30 days and may be retained longer under certain legal and security exceptions. PlanWalkVR uses the setting that disables storage of responses at the API level; this does not disable all provider logging or temporary technical storage.

4.8. AI usage records linked to the user and project may contain the question, response, rating, time, model, prompt version, number of tokens and credits used, estimated cost and technical request ID. Some AI requests also transmit a pseudonymous safety identifier derived from the user ID; this is not the email address itself, but it is not necessarily anonymous data.

4.9. Other project users do not automatically receive your personal chat history. If you save a response as a shared project report, authorised project users may then access its content. Reports saved in this way, the image catalogue and inspection documentation form part of the project; the 90-day retention period for personal chats does not automatically apply to them.

4.10. To investigate a specific bug report, handle a security event or identify a particular defect in the service being used, an authorised administrator of the Service Provider may access the question and response to the extent necessary to resolve the task. For project materials for which the customer is the controller, such access is a processor activity and must comply with the customer's documented instructions and the data processing agreement. Necessary processing for the Service Provider's own support and security records is governed by the legal bases in Sections 5.6 and 5.8. Such troubleshooting does not authorise general review of personal conversations for product development or training of the Service Provider's own AI model. Irreversibly anonymised samples containing no personal data may be used for general quality improvement; use of a sample that also contains personal data for that purpose requires a separate legal basis determined in advance and prior information, and, when acting as a processor, appropriate instructions from the customer. Data subjects may object under Section 11.6 to independent processing by the Service Provider that is based on legitimate interests.

4.11. PlanWalkVR does not use AI responses to make decisions based solely on automated processing that produce legal effects concerning a data subject or similarly significantly affect them. The AI is not an employee evaluation or personal identification tool. Technical checks of allowances and trial expiry follow predefined service rules; customer support may be contacted to dispute a restriction.

4.12. An AI response may contain inaccurate personal data. You may request rectification or erasure of that data; the requirement to verify a response professionally before using it does not restrict your data protection rights.

5. Billing communications and operational data

5.1. Billing and payment: we process the purchaser's name or business name, billing address, necessary tax identification details, email address, purchase and payment request details, amount, currency, credits granted, payment status and bank transfer details needed for identification. A bank record may contain the payer's name, bank account number and payment reference. We do not request payment card details in the current manual bank transfer process.

5.2. Necessary order and crediting data is processed on the basis of performance of a contract for individual purchasers and legitimate interests in administering the contract for organisational contact persons. Billing and accounting obligations are based on Article 6(1)(c) GDPR, in particular Section 169 of the Hungarian Accounting Act and tax rules. Providing a service free of charge does not, in itself, make all user data accounting data.

5.3. Service emails: we use your email address, name, language and account or workspace data needed for the message to communicate verification, invitations, password resets, security notices, access expiry, allowances and credit transactions. These are not newsletters. Their legal basis is performance of the underlying contract, legitimate interests for organisational communications, or a legal obligation where the communication is required by law.

5.4. Customer support and Feedback: we process your message and its category, identification and contact details, project, permissions, information referring to the selected room and images, view and save status, project structure diagnostics, browser and device characteristics, IP address and submission time. The diagnostic package may contain project names and image IDs, not just general browser information.

5.5. If you attach a screenshot, a single image of the selected screen, window or browser tab is included in the report. It may show another application, a notification or personal data. Check the preview before submitting and do not attach unnecessary data. A screenshot is optional; this feature does not continuously record audio or video. Browser permission to share a screen does not, in itself, constitute general consent under the GDPR.

5.6. Customer support processing may be based on fulfilment of your contractual request; voluntary bug reports and necessary diagnostics are based on Article 6(1)(f) GDPR. Our legitimate interest is to investigate the reported defect and provide a reliable service. The report is sent to AiPlanLab, not automatically to an external AI assistant. We remove or obscure unnecessary personal content.

5.7. For consumer complaints, we process the complaint's content, the customer's name and contact details, details of the transaction, the complaint record and our response. Mandatory complaint records are based on Article 6(1)(c) GDPR and Section 17/A of the Hungarian Consumer Protection Act. Retention of documents necessary to pursue legal claims is based on Article 6(1)(f).

5.8. Security and operational records may include successful or failed logins, the email address entered, IP address, browser identifier, time, user and project IDs, save, upload, deletion, permission and administrative events, and error and alert data. The purposes are to prevent unauthorised access and abuse, investigate errors and trace changes. The legal basis is our legitimate interest in system security under Article 6(1)(f) GDPR.

5.9. Internal operational reports examine registrations, project activity, storage use, AI operations and costs. This data is not necessarily anonymous: administrative reports may be linked to users and workspaces. The daily internal summary sent at 20:30 to info@aiplanlab.com may include newly registered users' email addresses and operational totals. Processing is based on legitimate interests in operating the service, planning capacity and controlling costs; it is not profiling for advertising purposes.

5.10. We do not currently use Google Analytics, Meta Pixel or other marketing tracking, and we do not have a separate newsletter system. Before introducing a newsletter, marketing tracking or a new processing purpose, we will provide separate information and, where required, obtain voluntary, separate consent. Registering or reading this Notice does not constitute advance subscription to those future purposes.

6. Sources of data and retention periods

6.1. Account, contact and order data is primarily provided by you. For invitations, the inviting workspace manager may provide the email address and membership details. Project materials may come from the uploader or project editor, payment data from the payer and payment records, and AI results from the analysis service. Operational and device data is generated through use of the service.

6.2. If the Service Provider obtains data other than directly from you while acting as an independent controller, it provides the information required by Article 14 GDPR, subject to applicable exceptions, no later than one month after obtaining the data, or when first communicating with you or disclosing the data earlier. The invitation email makes the purpose of the invitation and this Privacy Notice available.

6.3. Account data: for the lifetime of the account and then for the period necessary to process deletion, up to 30 days. We retain data from incomplete, unverified registrations and unaccepted invitations for 30 days from the last such initiation. Residual records of expired or used account management tokens are subject to the same deletion period of up to 30 days. The separate periods below apply to the minimum records needed for legal obligations or claims.

6.4. Project materials: throughout service access and the retention period applicable to the project. After access expires, the 180-day retention and export period under the Terms and Conditions applies. We give at least 30 days' notice before the planned permanent deletion of a project. This does not exclude an earlier deletion request by an authorised person and does not retrospectively shorten a more favourable retention commitment previously made to the customer.

6.5. Images placed in the recycle bin may be retained for restoration for 30 days from deletion, after which regular maintenance permanently removes the relevant files and image variants. The recycle bin is not an unlimited archive. For a data subject's erasure request, we separately assess whether earlier permanent removal is required.

6.6. Personal AI conversations: as a rule, question and response content remains in the history and content log for no more than 90 days from creation. Deleting that content does not automatically delete a project report saved separately from it or the operational data needed for accounting for usage. Shared reports, the image catalogue and project versions follow the retention period applicable to project materials.

6.7. Security, access and detailed activity logs: up to 90 days from the event. Non-accounting AI usage metadata and internal operational summaries: up to one year from creation. Data separated out as necessary for a specific incident or dispute may be retained until the matter is finally resolved or until the applicable period for bringing claims expires. Irreversibly anonymised aggregates may be kept thereafter.

6.8. Customer support cases and Feedback, including screenshots and diagnostic data: up to one year after closure of the case; attachments no longer needed must be deleted earlier. Formal consumer complaints and substantive responses: three years under the Hungarian Consumer Protection Act. Documents needed for a substantiated legal claim may be retained until the limitation period for that claim expires; for civil claims this is generally five years, but it does not authorise retention of all project photographs or chats for that period.

6.9. Accounting documents and the necessary supporting transaction data: at least eight years under the Hungarian Accounting Act; under the internal disposal schedule, until the end of the eighth year following the relevant financial year, or longer if a specific legal provision or ongoing proceedings require it. Non- accounting data needed to prove the conclusion and terms of the contract, including the content, version and language of the accepted Terms and Conditions, the time of acceptance and its attribution to a person, related declarations and confirmations, may generally be retained for five years after the contract ends. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is to establish contractual rights and obligations and to establish, exercise and defend legal claims. Specific proceedings or circumstances affecting limitation periods may affect how long necessary evidence is retained; this does not justify retaining the entire project materials or chat for that period.

6.10. Outgoing emails: the encrypted message body in the application's sending queue is deleted after successful acceptance by the email provider; maintenance applies a retention period of no more than seven days to message bodies remaining in the queue. Separately, a sent copy may remain in the Microsoft mailbox. Mailbox copies and sending metadata containing the recipient, subject and status follow the retention period for the underlying matter described above; they do not form an unlimited email archive.

6.11. Backups: up to one year from creation of the backup. Data deleted from the active system may therefore remain in an earlier, separate backup until that backup expires. We use these copies solely for restoration and necessary security tasks, not for ordinary customer service, analysis or marketing. On restoration, we reapply deletions completed in the meantime. Copying a backup does not restart the one- year retention period.

6.12. Backups allow restoration after data loss; for our own processing, the legal basis is our legitimate interest in continuity and data security under Article 6(1)(f) GDPR. Backups of customer project data are also governed by the data processing agreement and the customer's instructions. The one-year backup period does not extend the period during which active use is permitted.

6.13. Permanent erasure or genuine anonymisation removes the link to an individual; merely hiding a name or using an internal identifier does not necessarily amount to anonymisation. Copies lawfully exported by another user cannot automatically be deleted through deletion initiated in the Service Provider's system. The controller determining the use of those copies is responsible for their processing.

7. Recipients and service providers

7.1. Persons authorised to perform tasks for the Service Provider have access to the necessary categories of data. Authorised workspace and project members may access data according to their roles; membership does not automatically provide access to another person's private chat history. The following service providers receive only data connected with their tasks, not necessarily the entire dataset.

7.2. Tárhely.Eu Szolgáltató Kft. – 1097 Budapest, Könyves Kálmán körút 12–14., Hungary; https://tarhely.eu. Task: hosting the web application, database and related technical files. Data concerned: account and project databases, logs, temporary processing files and certain uploaded or support files. It acts as a processor for this service and as a subprocessor in relation to customer content.

7.3. Cloudflare, Inc. – 101 Townsend Street, San Francisco, CA 94107, United States; https://www.cloudflare.com. Task: R2 storage of images, previews and other objects. PlanWalkVR's bucket operates with an EU jurisdiction restriction and non-public access. Restricting data storage to the EU does not mean that all related administrative or support processing by the provider takes place exclusively within the EU. It acts as a processor or subprocessor for this service.

7.4. OpenAI Ireland Ltd. – Ireland; https://openai.com. Task: AI analysis through the API. Data concerned: the question, image and text context, analysis result and necessary technical identifiers described in Section 4. It provides services under the OpenAI data processing terms applicable to customers established in the EEA; affiliates and further subprocessors may also participate in providing the service.

7.5. Microsoft Ireland Operations Limited – Ireland; contact address: One Microsoft Place, South County Business Park, Leopardstown, Dublin 18; https://www.microsoft.com. Task: Microsoft 365 email and transactional email sending through Microsoft Graph. Data concerned: sender and recipient, subject, message content and related delivery and security data. It acts as a processor under its service terms; Microsoft's terms also define its roles for necessary service security and business operations of its own.

7.6. KBOSS.hu Kereskedelmi és Szolgáltató Kft. – 1031 Budapest, Záhony utca 7., Hungary; operator of Számlázz.hu; https://www.szamlazz.hu. Task: invoicing, document management and related statutory reporting. Data concerned: billing and transaction data and contact details needed to deliver the invoice. It acts as a processor for invoice issuance and may also act as an independent controller for its own statutory purposes. We do not send project images or chats for this purpose.

7.7. SEVERUS Kft. – 2119 Pécel, Tas vezér utca 40., Hungary. Task: bookkeeping and necessary accounting and tax tasks. Data concerned: invoices, payment records and necessary transaction and contact data. It acts as a bookkeeping processor under its engagement and bears its own controller responsibility for its independent statutory obligations.

7.8. Banks involved in the payment transaction, the Hungarian National Tax and Customs Administration and other authorised authorities may receive data required by law, acting as independent controllers within their own remit. In a specific legal matter, a lawyer or other professional representative may also access data necessary for that matter. We disclose data in response to an authority's request only with an appropriate legal basis and to the appropriate extent.

7.9. We engage processors subject to appropriate contractual terms. Further processors of customer project data are also subject to the authorisation and change management rules in the separate data processing agreement. Use of the application's support feature does not make the data publicly accessible.

7.10. When you use Google sign-in, Google’s own authentication service participates in the process. In the EEA, the provider under Google’s privacy policy is Google Ireland Limited, Ireland. Google is independently responsible for processing related to its own service and may process technical data such as IP addresses, browser information and the sign-in event under its own rules. Sections 3.7–3.12 govern data received by PlanWalkVR. Google’s own processing, retention and international transfers are explained at https://policies.google.com/privacy?hl=en.

8. Transfers outside the EEA

8.1. Through international cloud and AI providers, personal data may be transferred outside the EEA, particularly to the United States, or become accessible from there. Cloudflare R2 storage in the EU does not automatically ensure that OpenAI processing, or all related Microsoft and Cloudflare services, take place within the EU.

8.2. Such transfers may take place subject to an appropriate condition under Chapter V GDPR. The European Commission's standard contractual clauses included in the providers' data processing terms and necessary supplementary safeguards apply where there is no adequacy decision valid for the recipient and transfer concerned. Information on appropriate safeguards and copies of the relevant documents may be requested at info@aiplanlab.com, taking into account the rights of others and protected business information.

8.3. We do not treat use of the application or acceptance of the Terms and Conditions as general consent to unlimited transfers to third countries without protection. The legal basis for processing and the safeguards for international transfers must be established separately.

9. Cookies local storage and device permissions

9.1. The logged-in application uses a session cookie named PWVRSESSID. Its purpose is to maintain an authenticated session and secure access. It is a first-party cookie scoped to the application path, not an advertising tracker. It is a session cookie; browser session restoration settings mean that closing the browser does not always remove it immediately. Logging out ends server-side access.

9.2. Browser local storage may retain language and view preferences, panel sizes, selection settings and a project draft in case saving fails. Examples include pwvr.language, pwvr_account_lang and entries prefixed with pwvr.save-draft.v1. A draft may contain project structure, names, image references and save status; it is not a local backup of the full image files.

9.3. Some local storage entries have no automatic expiry: they may remain until the setting is changed, the draft is removed after a successful save, or browser site data is cleared. Logging out does not necessarily delete all local data. On a shared computer, use a separate browser profile where possible and clear site data when you finish; doing so may also remove a draft that has not yet been saved.

9.4. Session management and local storage strictly necessary to provide the requested service are not marketing tracking. We assess the lawfulness of storage on the device separately from the legal basis for subsequent processing of personal data. We activate non-essential analytics or marketing tools only after obtaining the prior consent required by law; refusing such tools must not prevent use of the necessary service.

9.5. Taking a photograph directly requires browser permission for the camera, and taking a screenshot requires permission for the selected screen or window. These features start through user action. Permission can be withdrawn in the browser; this may prevent further use of the feature, but does not by itself delete a file previously submitted deliberately to the server. Uploading an image in another way or reporting a problem without a screenshot remains possible.

9.6. Google sign-in starts a redirect and authentication data exchange only after you press its button. Merely opening the PlanWalkVR login page does not load Google sign-in tracking code. Cookies and technical processing on Google’s own page are governed by Google’s notice and the settings provided there; PlanWalkVR uses its own session to handle the return and authenticated login.

10. Data security and breaches

10.1. The Service Provider implements technical and organisational measures appropriate to the risk. These include access controls, private image storage, encrypted network connections, one-way password hashes, operational and security logging, abuse controls, backups and restoration. Server-side secret access credentials are not published in files intended for the browser.

10.2. Data security does not guarantee the elimination of every risk. You must also protect your devices appropriately, use a unique password and allocate project permissions carefully. You must protect files saved or exported to your own device. These circumstances do not release the Service Provider from its own data security obligations.

10.3. In the event of a personal data breach, we assess the affected data and risks, take the necessary measures and document the incident. Where the conditions in the GDPR are met, we notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If the risk is high, we also inform affected individuals without undue delay, subject to statutory exceptions. When acting as a processor, we notify the customer controller without undue delay.

11. Your data protection rights

11.1. Access and copies: you may ask us to confirm whether we process your personal data and request information on the data, purposes, recipients, retention and sources. You may also request a copy under Article 15 GDPR, respecting the rights of other persons.

11.2. Rectification: you may request correction of inaccurate personal data and completion of incomplete data. You may also report an inaccurate AI-generated statement about you; we take the nature of the statement and the related document into account when resolving the matter.

11.3. Erasure: you may request deletion of your personal data in the circumstances set out in Article 17 GDPR, for example where the purpose has ceased or processing is unlawful. Deletion does not necessarily extend to data required for a legal obligation or legal claim. We explain the specific grounds for any refusal; the existence of a backup is not, by itself, a general ground for refusing a request.

11.4. Restriction: subject to Article 18 GDPR, you may request restriction of processing, for example while accuracy is being verified or where you request restriction instead of erasure of unlawfully processed data. Restricted data may be processed further only in the circumstances specified by the GDPR.

11.5. Data portability: where processing is based on consent or a contract with you and is carried out by automated means, you may request the data you have provided in a structured, commonly used, machine- readable format under Article 20 GDPR and, where technically feasible, its direct transmission. This is not an unconditional right to receive all data relating to other people in an entire company project.

11.6. Objection: you may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests. We then stop processing unless continued processing is justified by compelling legitimate grounds overriding your interests and rights or by legal claims. You may object at any time, without giving reasons, to processing for direct marketing; the data may no longer be processed for that purpose thereafter.

11.7. Withdrawal of consent: where processing genuinely relies on consent, you may withdraw it at any time as easily as you gave it. This does not affect the lawfulness of processing before withdrawal and does not end processing of data that must be retained on another independent legal basis.

11.8. Submitting a request: you may write to info@aiplanlab.com or the Service Provider's correspondence address. We respond without undue delay and no later than one month after receiving your request. For complex or numerous requests, this may be extended by a further two months; we inform you of the extension and the reasons within the first month.

11.9. Requests are generally handled free of charge. For a manifestly unfounded or excessive request, a reasonable fee may be charged or action refused under the GDPR's conditions and burden of proof. If there are doubts about identity, we request only necessary and proportionate additional identification information; a copy of an identity document is not a general prerequisite.

11.10. If we do not act on your request, we explain the reason and the available remedies. If data has been rectified, erased or restricted, we notify the relevant recipients under Article 19 GDPR unless this is impossible or involves disproportionate effort; on request, we also inform you about those recipients. We retain necessary evidence of handling requests solely for accountability and legal claims purposes, in accordance with Section 6.

12. Complaints and remedies

12.1. You may contact us directly with a data protection concern, but this is not a prerequisite for a remedy before an authority or court. You may lodge a complaint with the competent data protection supervisory authority in the place of your habitual residence, place of work or the alleged infringement.

12.2. In Hungary, the competent authority is the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH). Address: 1055 Budapest, Falk Miksa utca 9–11. Postal address: 1363 Budapest, Pf. 9. Website: https://www.naih.hu. Customer service email: ugyfelszolgalat@naih.hu. Formal administrative proceedings cannot be initiated by ordinary email; the NAIH website explains the appropriate submission methods and electronic procedures.

12.3. You may also seek a judicial remedy under Article 79 GDPR, generally, under the applicable jurisdiction rules, in the Member State where the controller has an establishment or where you have your habitual residence. Where the conditions of Article 82 GDPR are met, you may claim compensation for material or non-material damage. This Notice and the Terms and Conditions do not exclude those rights.

13. Changes and further information

13.1. Under the service terms, registered users must be adults. This does not mean that personal data of a child appearing incidentally in a project image may be processed without protection. Do not upload unnecessary data about children; if we discover such data or receive a report of unauthorised registration by a minor, we take measures appropriate to the circumstances.

13.2. We provide appropriate information before applying a new processing purpose or material changes to data categories or safeguards. If the new processing requires consent, we request it separately. Changing this Notice does not, by itself, make earlier processing without a legal basis lawful or retrospectively extend retention without justification.

13.3. The current Notice is accessible from the application. You may request further information at info@aiplanlab.com on the substance of processing based on legitimate interests, specific recipients, safeguards for international transfers and retention arrangements for your own data.

Referenced legislation and provider information

The official sources below help explain the rules and provider terms referred to in this Notice. Provider documents may be updated; they do not replace responsibility for PlanWalkVR's actual processing of personal data.

A question about your data?
info@aiplanlab.com · AiPlanLab Kft.

Privacy Notice