Privacy Policy
2nd Space services are operated by Cromwell Global Media Kft. This policy describes how we handle personal data.
GDPR compliance • Transparent data processing • Your security is our priority
2nd-space.com - In force from 1 October 2025
This is a courtesy translation provided for convenience; the Hungarian version is legally binding.
CROMWELL GLOBAL MEDIA KFT.
Registered office: 1054 Budapest, Bajcsy-Zsilinszky út 58.
Company registration number: 01-09-334831
Tax number: 26608206-1-41
Represented by: Deli Zoltán, Managing Director
1. Introduction
Data protection matters a great deal to our business, and we want to be open and transparent in the way we process your personal data. In providing our short-term office hire service under the 2nd Space brand, we handle your personal data with the greatest care.
Who processes your personal data?
Data controller: CROMWELL GLOBAL MEDIA KFT.
Brand name: 2nd Space
Postal address: 1054 Budapest, Bajcsy-Zsilinszky út 58.
E-mail address: info@cafeenglish.eu
Telephone: +36 1 987 6831
Website: www.2nd-space.com
In drawing up this policy we have paid particular regard to Regulation (EU) 2016/679 of the European Parliament and of the Council (the GDPR), Act CXII of 2011 on informational self-determination and freedom of information (the Information Act) and Act V of 2013 on the Civil Code.
2. Key definitions
To make this Privacy Policy easier to follow, the definitions the GDPR gives for the main data protection concepts are set out below:
personal data:
Any information relating to an identified or identifiable natural person (the “data subject”).
processing:
Any operation performed on personal data or on sets of personal data, whether or not by automated means.
controller:
The natural or legal person which determines the purposes and means of the processing of personal data.
consent of the data subject:
A freely given, specific, informed and unambiguous indication of the wishes of the data subject.
3. Purpose and legal basis of processing
3.1. Processing connected with the room hire service
| Categories of data processed | Purpose of processing | Legal basis for processing | Retention period |
|---|---|---|---|
| • Name • E-mail address • Telephone number • Billing details | Performance of the hire contract, keeping in contact | Performance of a contract (Article 6(1)(b) GDPR) | Until contractual claims become time-barred (5 years) |
| • Company name • Tax number • Registered office | Invoicing (business hirers) | Legal obligation (Article 6(1)(c) GDPR) | Retention of accounting documents: 8 years |
| • Use of entry codes | Providing secure entry | Legitimate interest (Article 6(1)(f) GDPR) | Until the end of the hire period |
3.2. Processing connected with operating the CCTV system
| Categories of data processed | Purpose of processing | Legal basis for processing | Retention period |
|---|---|---|---|
| • Video image • Time of recording | • Protection of property • Personal safety • Evidence of unlawful acts | Legitimate interest (Article 6(1)(f) GDPR) | 72 hours (3 days), automatic deletion |
Important: The CCTV system covers only the shared areas (corridor, entrance hall, kitchen, break area). There is no camera monitoring in the workspaces, the offices or the washrooms.
3.3. Operating the online booking system
| Categories of data processed | Purpose of processing | Legal basis for processing | Retention period |
|---|---|---|---|
| • Registration data • Booking history • Discounts, coupons | Operating the booking system, providing discounts | Performance of a contract (Article 6(1)(b) GDPR) | 5 years after the last booking |
3.4. Complaints handling
| Categories of data processed | Purpose of processing | Legal basis for processing | Retention period |
|---|---|---|---|
| • Name of the complainant • Contact details • Content of the complaint | Investigating and answering the complaint | Legal obligation (Consumer Protection Act) | 5 years |
4. Data processors
We use the following data processors in providing our services:
4.1. Payment provider
Name: Stripe, Inc.
Registered office: 510 Townsend Street, San Francisco, CA 94103, USA
Activity: processing online card payments
Legal basis for the transfer: EU-US Data Privacy Framework
4.2. Invoicing provider
Name: KBOSS.hu Kft. (Számlázz.hu)
Registered office: 2000 Szentendre, Táltos u. 22/B
Activity: electronic invoices and receipts
4.5. Google Analytics
Name: Google LLC
Activity: website visitor statistics (anonymised data)
5. Data security
5.1. Technical and organisational measures
- SSL encryption on the website
- Password-protected access to the electronic systems
- The use of permission levels
- Regular backups
- Paper documents kept in a lockable cabinet
5.2. Security of the entry codes
- We send the entry codes by encrypted e-mail
- The codes change regularly
- Immediate blocking in the event of unauthorised use
5.3. Security of CCTV recordings
- Storage in a closed system
- Access logging
- Automatic deletion after 72 hours
6. Use of cookies
Our website uses cookies in order to improve the user experience. Detailed information about how cookies are handled can be found in our Cookie Policy.
Cookie types:
Necessary cookies:
Essential for the website to work
Analytics cookies:
Producing visitor statistics
Marketing cookies:
Personalised offers (with consent only)
7. Rights of data subjects
Under the GDPR you have the following rights in relation to the processing of your personal data:
7.1. Right of access
You may ask us at any time to tell you:
- whether we process any personal data about you
- what data we process
- what our purpose in processing it is
- to whom we transfer the data
- how long we store the data
7.2. Right to rectification
You may ask us to correct or complete any inaccurate or incomplete data about you.
7.3. Right to erasure (the “right to be forgotten”)
You may ask us to erase your data if:
- the data are no longer needed
- you withdraw your consent
- you object to the processing
- we processed your data unlawfully
7.4. Right to restriction of processing
You may ask us to restrict processing if:
- you contest the accuracy of the data
- the processing is unlawful
- we no longer need the data, but you require them in order to establish a legal claim
7.5. Right to data portability
You may ask to receive your data in a structured, machine-readable format.
7.6. Right to object
You may object to the processing of your personal data where the legal basis for the processing is legitimate interest.
7.7. Automated decision-making
We do not use automated decision-making or profiling.
8. How to enforce your rights
8.1. Contacting the data controller
Please contact us with any questions or comments:
E-mail: info@cafeenglish.eu
Telephone: +36 1 987 6831
Postal address: 1054 Budapest, Bajcsy-Zsilinszky út 58.
8.2. Complaint to the supervisory authority
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa u. 9-11.
Telephone: +36 (1) 391 1400
E-mail: ugyfelszolgalat@naih.hu
Website: www.naih.hu
Postal address: 1363 Budapest, Pf.: 9.
8.3. Judicial remedy
If your rights are infringed you may bring proceedings before a court. Such cases fall within the competence of the regional court. Proceedings may also be brought before the regional court for your place of residence or stay.
9. Data transfers
9.1. Transfers to a third country
Data transferred to Stripe Inc. go to the USA, which provides an adequate level of protection under the EU-US Data Privacy Framework.
9.2. Transfers to public authorities
We transfer data on the basis of a statutory obligation:
- to the Hungarian tax authority NAV (invoicing data)
- to law enforcement bodies (CCTV recordings, upon request)
10. Protection of children's data
Our services may be used by persons over the age of 18. Persons under 18 may use our services only with the consent and supervision of a parent or guardian.
11. Handling personal data breaches
In the event of a personal data breach:
- we report it to NAIH within 72 hours
- where the risk is high, we notify the data subjects
- we keep a record of breaches
- we take measures to prevent future breaches
12. Amendment of this Privacy Policy
We may amend this Privacy Policy at any time. We will inform data subjects of any amendment on our website. The version of the Privacy Policy in force at any given time is available on our website.
In force from: 1 October 2025
13. Annexes
13.1. CCTV system information notice
A detailed notice on the operation of the CCTV system is available on site and on our website.
13.2. Cookie Policy
Detailed information on the use of cookies can be found in our Cookie Policy.
Budapest, 26 September 2025
CROMWELL GLOBAL MEDIA KFT.
Represented by: Deli Zoltán
Managing Director
This policy has been drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the GDPR) and with Hungarian data protection legislation.