BEEPY
Privacy Policy
This Privacy Policy explains how GBPY Kereskedelmi Kft. ('Beepy', 'we', 'us', 'our') collects, uses, and protects your personal data when you use our website, products, and services.
Please read this document carefully.
1. Data Controller
For all data protection enquiries, please contact us at mkeszler@getbeepy.com.
| Field | Details |
|---|---|
| Company name | GBPY Kereskedelmi Kft. |
| Trading name | Beepy |
| Registered address | 2096 Üröm, Völgyliget sétány 38. A. ép., Hungary |
| Tax number | 33069988-2-13 (company reg. no.: 13-09-247651) |
| Website | https://getbeepy.com |
| General contact / Support | hello@getbeepy.com · support@getbeepy.com |
| Data Protection contact | mkeszler@getbeepy.com |
| DPO name | Matyas Keszler |
2. Personal Data We Collect
2.1 Account & Registration Data
When you create a Beepy account, we collect:
- Full name
- Email address
- Password (stored as a one-way hash — we never store your plain-text password)
- Phone number (optional, used for account recovery)
- Preferred language
2.2 Location Data
Beepy is a GPS tracking service. When a Beepy device is active, it transmits:
IMPORTANT: Location data is sensitive personal data. It is only collected with the explicit consent of the account holder who purchased and activated the device.
Location data is encrypted in transit (TLS) and at rest on our EU servers (Hetzner, Helsinki, Finland).
- Real-time GPS coordinates of the tracked device
- Location history (last 30 days)
- Movement status and speed
- Geofence entry/exit events
2.3 Device & Technical Data
- Beepy device IMEI number
- SIM card identifier (ICCID)
- Device battery level and connectivity status
- Device firmware version
2.4 Purchase & Billing Data
When you purchase a Beepy device or a yearly renewal, we collect:
We do not store your full payment card details. All payments, including renewals purchased inside the Beepy iOS app, are processed by Stripe, Inc. (see Section 5); Apple does not process them.
- Name and billing address
- Order details and order history
- Payment confirmation data (payment method type, last 4 digits of card)
2.5 Communication Data
- Customer support messages and email correspondence
- Records of voice or audio calls made through the Beepy two-way calling feature
3. Legal Basis for Processing
| Purpose | Legal Basis |
|---|---|
| Account creation & management | Performance of contract (Art. 6(1)(b) GDPR) |
| GPS location tracking service | Performance of contract (Art. 6(1)(b) GDPR) |
| Processing payments & invoicing | Legal obligation + contract (Art. 6(1)(b)(c) GDPR) |
| Customer support | Legitimate interest — service quality (Art. 6(1)(f) GDPR) |
| Security logs & fraud prevention | Legitimate interest — security (Art. 6(1)(f) GDPR) |
| Email marketing (if applicable) | Consent (Art. 6(1)(a) GDPR) |
4. Data Retention
When retention periods expire, data is permanently deleted or irreversibly anonymised.
| Data Type | Retention Period |
|---|---|
| Account data | Duration of the account; after a deletion request, a 30-day revocable grace period, then permanent deletion (invoices are retained separately for 8 years) |
| Location history | 30 days rolling (auto-deleted) |
| Purchase / invoice records | 8 years (Hungarian accounting law requirement) |
| Customer support records | 3 years from last interaction |
| Security & audit logs | 1 year |
5. Data Processors & Third Parties
We use the following trusted third-party services. Each has a Data Processing Agreement (DPA) in place with us. All EU data remains within the EEA or is transferred under Standard Contractual Clauses (SCCs).
We do not sell your personal data to any third party. We do not share your data with advertisers.
| Processor | Role & Data Protection Basis |
|---|---|
| Hetzner Online GmbH | Server hosting — GPS/location data, app data. Location: Helsinki, Finland (EU). DPA: Yes. |
| Cloudflare, Inc. | Website hosting, DNS and CDN. DPA & SCCs: Yes. |
| Vercel Inc. | Website application hosting (from go-live). EU-region deployment; DPA & SCCs: Yes. |
| MongoDB Atlas (MongoDB Ltd.) | Managed database for orders and customer records (from go-live). Hosted in Frankfurt, Germany (EU). DPA: Yes. |
| Stripe, Inc. | Payment processing. EU data stored in EU. DPA & SCCs: Yes. Does not store full card data on Beepy servers. |
| Google Ireland Ltd. (Firebase) | Firebase Authentication and Cloud Messaging (push notifications) — account identifiers, e-mail address, push tokens. EU data residency configured. DPA: Yes. |
| Resend, Inc. | Transactional email delivery. DPA & SCCs in place. EU data routing applied. |
6. Your Rights Under GDPR
To exercise any of these rights, contact us at mkeszler@getbeepy.com (data protection matters). Account deletion can be initiated directly on the website, within the app, or by emailing support@getbeepy.com: upon request the account becomes inactive and a 30-day grace period begins, during which the deletion may be revoked; after it expires, the account and its data are permanently deleted, except for invoicing records retained for 8 years under Hungarian accounting law. We will respond within 30 days. Requests are free of charge.
You also have the right to lodge a complaint with the Hungarian supervisory authority:
Nemzeti Adatvedelmi es Informaciószabadsag Hatosag (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9-11.
Website: naih.hu
Email: ugyfelszolgalat@naih.hu
Phone: +36 (1) 391-1400
| Right | Description |
|---|---|
| Right of access | Request a copy of all personal data we hold about you (Art. 15) |
| Right to rectification | Correct inaccurate or incomplete data (Art. 16) |
| Right to erasure | Request deletion of your data ('right to be forgotten') (Art. 17) |
| Right to restriction | Request that we limit processing of your data (Art. 18) |
| Right to portability | Receive your data in a structured, machine-readable format (Art. 20) |
| Right to object | Object to processing based on legitimate interests (Art. 21) |
| Right to withdraw consent | Withdraw marketing consent at any time (Art. 7(3)) |
| Right to complain | Lodge a complaint with the supervisory authority (Art. 77) |
7. Cookies
We only use cookies and similar browser storage that are strictly necessary for the website to work, for example to keep you signed in and to remember your language. We do not use analytics, advertising or tracking cookies, so no consent is required. For details, see our Cookie Policy.
8. Children's Privacy
Beepy devices are designed for use by families and may be used to track children with parental consent. However, Beepy accounts may only be created by persons aged 18 or over. The account holder (parent or guardian) is responsible for ensuring the appropriate use of Beepy devices with minors.
We do not knowingly collect personal data directly from children under the age of 16.
9. Data Security
In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the NAIH within 72 hours of becoming aware, as required by GDPR Art. 33-34.
- All data transmitted between devices, the app, and our servers is encrypted using TLS 1.2+
- Location data is encrypted at rest on our servers
- Access to personal data is restricted to authorised personnel only
- Our servers are located in the EU (Hetzner, Helsinki, Finland)
- We conduct regular security reviews
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (if you have an account) and by displaying a notice on our website. The date at the top of this document reflects the most recent update.
Continued use of our services after changes are posted constitutes acceptance of the updated policy.