# Privacy Notice - Link: https://digiosveny.hu/en/adatkezelesi-nyilatkozat/ - Published: 2025-11-26T23:11:41+01:00 - Author: Márton Digiösvény • Information Pursuant to Articles 13–14 of the GDPR # Privacy Notice This notice summarizes how Digiösvény processes the personal data of visitors, prospective clients, customers, and customer service users. Base version: August 10, 2026. Updated: October 16, 2026. Version: PRIV-2026- 08-10 + WEB-LEGAL-2026-10-16-v1 ## Contents of the Document [Data Controller](https://digiosveny.hu/en/adatkezelesi-nyilatkozat/#adatkezelo)[Source and Principles](https://digiosveny.hu/en/adatkezelesi-nyilatkozat/#elvek) [Legal Bases](https://digiosveny.hu/en/adatkezelesi-nyilatkozat/#jogalapok)[Website and Security](https://digiosveny.hu/en/adatkezelesi-nyilatkozat/#weboldal) [Forms and Request for Proposal](https://digiosveny.hu/en/adatkezelesi-nyilatkozat/#kapcsolat) [Communication](https://digiosveny.hu/en/adatkezelesi-nyilatkozat/#kommunikacio)[Customer and Project Management](https://digiosveny.hu/en/adatkezelesi-nyilatkozat/#crm) [Customer Service](https://digiosveny.hu/en/adatkezelesi-nyilatkozat/#support)[AI Features](https://digiosveny.hu/en/adatkezelesi-nyilatkozat/#ai) [Consent](https://digiosveny.hu/en/adatkezelesi-nyilatkozat/#hozzajarulas)[Statistics and Marketing](https://digiosveny.hu/en/adatkezelesi-nyilatkozat/#meres) [Notifications and Language](https://digiosveny.hu/en/adatkezelesi-nyilatkozat/#push)[Recipients and Forwarding](https://digiosveny.hu/en/adatkezelesi-nyilatkozat/#cimzettek) [Retention](https://digiosveny.hu/en/adatkezelesi-nyilatkozat/#megorzes)[Data Subject Rights](https://digiosveny.hu/en/adatkezelesi-nyilatkozat/#jogok) [Automated Decision-Making](https://digiosveny.hu/en/adatkezelesi-nyilatkozat/#automatizalt) [Amendment](https://digiosveny.hu/en/adatkezelesi-nyilatkozat/#modositas) ## 1. The Data Controller Data Controller: Márton Horváth Business Name: DigiXRAY Labs Webentwicklung & Webdesign Brand Name and Website: Digiösvény – [https://digiosveny.hu/](https://digiosveny.hu/) Registered office and mailing address: Wallstraße 37, 55122 Mainz, Germany Email: [hello@digiosveny.hu](https://digiosveny.hu/en/adatkezelesi-nyilatkozat/hello@digiosveny.hu) Phone [+36 70 802 4667](https://digiosveny.hu/en/adatkezelesi-nyilatkozat/+36708024667) Data protection inquiries, requests from data subjects, objections, or withdrawals of consent may be submitted using the contact information above. The data controller has not appointed a separate data protection officer . ## 2. Source of Data and Principles of Data Processing Data is primarily provided by the data subject when contacting us, requesting a quote, during a website audit, project needs assessment, via email, phone, AI chat, customer service ticket, or in the course of contract performance. Technical data may be automatically generated by the browser, the hosting provider, the security system, and—with appropriate consent—by measurement or advertising services. If data does not originate directly from the data subject—for example, from an organizational contact person, from a file provided by the Client, from a public business source, or from a technical service provider—the data controller will use only the data necessary for the specific matter and will provide the information required under Article 14 of the GDPR within the applicable timeframe, unless a lawful exemption applies. The data controller processes personal data in a manner that is purpose-limited, to the extent necessary, accurately, securely, and for a period appropriate to the purpose. It is not necessary to submit special categories of personal data, passwords, credit card information, copies of documents, or other unnecessarily sensitive information; such data must not be provided in the free-text fields of forms or in the AI chat. ## 3. Legal Bases Applied | Legal Basis | When is it applicable? | Typical example | | GDPR Article 6(1)(a) | Voluntary, specific, informed, and revocable consent. | Not required for cookies, statistics, marketing, newsletters, or web push notifications. | | GDPR Article 6(1)(b) | Performance of a contract or pre-contractual measures taken at the data subject’s request. | Request for a quote, audit request, project coordination, order, support. | | GDPR Article 6(1)(c) | A legal obligation to which the data controller is subject. | Accounting, tax, consumer protection, or regulatory obligations. | | GDPR Article 6 (1)(f) | Legitimate interests of the data controller or a third party, provided that the data subject’s rights do not take precedence. | IT security, fraud prevention, maintaining business relationships, legal claims. | In the case of data processing based on consent, consent may be withdrawn at any time with future effect. Withdrawal does not affect the lawfulness of prior data processing. ## 4. Website Hosting, Storage, and Security Logs Contractual hosting, infrastructure, and security service providers may be used to operate the website. When the website is accessed, the following data may be processed: IP address, access time, requested URL, referring page, browser and device characteristics, response code, and security events. | Purpose | Legal Basis | Recipients | Retention Period | | Delivery, availability, and troubleshooting of the website; prevention of attacks and misuse. | GDPR Article 6(1)(f); where access to the end device is absolutely necessary, Section 25(2) of the TDDDG. | Hosting, infrastructure, and security service providers to the extent necessary. | For a short period commensurate with technical necessity; in the event of an incident, for evidentiary purposes, or to comply with a legal obligation, until the necessary procedure is completed. | As part of automated fraud and spam protection, technical browser, device, and network data may be transmitted to the relevant security service provider. ## 5. Contact, Audit, and Needs Assessment Forms In the context of web forms and direct inquiries, the following data may be processed in particular: name, email address, phone number, website address, message, project objective, service request, submission time, referring page, and technical metadata related to the submission. **Purpose:** identification, responding to inquiries, preparing quotes or audits, assessing needs, and documenting the inquiry and subsequent project. **Legal basis:** Article 6(1)(b) of the GDPR, if the inquiry is a step prior to entering into a contract; otherwise, Article 6(1)(f), legitimate interest in processing inquiries. Optional marketing may only take place with separate consent. ## 6. Email, Telephone, and Social Media Communication When contacting us via email or telephone, the following information about the sender or caller may be processed: name, email address, and phone number, as well as the content and date/time of the message or conversation, delivery and error information, and any replies and related attachments. **Purpose:** to respond to inquiries, provide quotes, fulfill contracts, handle complaints, provide customer service, and maintain verifiable documentation of business communications. **Legal basis:** Article 6(1)(b), (c), or (f) of the GDPR, depending on the nature of the matter. In the technical delivery of emails, the hosting, email account, or SMTP provider may act as a data processor. When a Facebook, Messenger, or WhatsApp link is opened, the relevant third-party service provider may process technical and account data at its own discretion. Digiösvény does not transmit the data provided on the form to to these service providers before the external service is opened. ## 7. Customer and Project Management Inquiries can be recorded in the customer and project management system. The following can be managed: contact information, basic case or project data, communication history, consent status, processing status, and internal administrative notes necessary for fulfillment. **Purpose:** consistent management of inquiries and projects, customer communication, fulfillment, quality assurance, and business administration. **Legal Basis:** Article 6(1)(b), (c), or (f) of the GDPR, depending on the specific data and purpose. Use for marketing purposes may only occur with an appropriate legal basis. ## 8. Customer Service Case Management The following data can be managed in the customer service interface: name, email, case ID, subject, message, category, priority, status, attachments, replies, timestamp, and the necessary technical log. **Purpose:** to receive, investigate, respond to, escalate, and document the resolution of support, complaint, billing, data protection, or security cases. **Legal Basis:** Article 6(1)(b), (c), or (f) of the GDPR, depending on the nature of the case. Customer service data may not be used for sales or advertising purposes without a separate legal basis. Do not send unnecessary passwords, complete credit card information, special categories of personal data, or other disproportionately sensitive information in attachments. ## 9. AI Assistant and AI-Supported Processing The website and service processes may use AI-supported features to provide responses, summaries, pre-screening, or task support requested by the user. In doing so, the following may be processed: the message, the conversation context, the session’s technical identifier, voluntarily provided contact or project information, as well as summary or categorization data necessary for handling the matter. * The communication interface will indicate when the user is communicating with an AI system. * The AI’s response may be incorrect; human review is required for contractual, legal, financial, data protection, or security-critical decisions. * Do not enter passwords, health data, identification documents, payment information, or other particularly sensitive information into the AI chat. * When using an external AI service provider, content necessary for operation may be in accordance with the applicable data processing and data transfer terms. **Legal Basis:** Article 6(1)(b) of the GDPR for functions requested by the user; Article 6(1)(f) of the GDPR for customer service and process security; for optional features or analytics, Article 6(1)(a), and, where necessary, Section 25 of the TDDDG. AI-assisted recommendations do not constitute independent, final business decisions. ## 10. Consent Management The consent management system handles choices regarding non-essential technologies. Within this framework, the consent ID, category, status, date, and time, as well as the technical data necessary to verify the decision, can be managed. **Purpose:** to implement, record, and verifiably document the selection. **Legal basis:** Consent processing pursuant to Section 25 of the TDDDG, as well as Article 6( 1)(c) and (f) of the GDPR for the purposes of fulfilling a legal obligation and ensuring the verifiability of consent . ## 11. Statistics, Behavioral Analysis, and Marketing Statistical, usability, advertising, and conversion tracking services—provided they are actually configured and active—may only be used after the appropriate consent category has been granted. | Data Processing | Characteristic Data | Legal Basis | Purpose | | Statistical Measurement | Pseudonymized visitor, device, event, source, and session data. | GDPR Article 6(1)(a); Section 25(1) of the TDDDG. | Traffic, performance, and content development. | | Usability and interaction measurement | Interaction, navigation, and usability data; the content of input fields may not be used for unnecessary measurement purposes. | GDPR Article 6(1)(a); TDDDG Section 25(1). | Analysis of usability errors and navigation patterns. | | Advertising and conversion measurement | Campaign, click, event, device, and pseudonymized advertising identifiers. | GDPR Article 6(1)(a); TDDDG Section 25(1). | Campaign impact, conversion, and—with separate consent—remarketing. | Detailed technical categories and retention periods can be found in the [Cookie Policy](https://digiosveny.hu/suti-tajekoztato/) and in the consent management interface. Unnecessary tracking codes must be technically blocked until the appropriate consent is granted. ## 12. Browser Notifications and Language Preferences ### Browser Notifications Browser notifications may only be sent with the browser’s explicit permission and—where necessary—after the appropriate consent. The subscription ID, device technical data, and notification interaction may be processed. Legal basis: Article 6(1)(a) of the GDPR. Consent may be withdrawn at any time in the browser or operating system settings. ### Language preference A local identifier or cookie may be used to record the language selection. The purpose is to ensure the language selected by the user. The legal basis, depending on the requested function, is Article 6(1)(b) or (f) of the GDPR, as well as the necessity exception under Section 25(2) of the TDDDG. ## 13. Recipients, Data Processors, and Third Countries As necessary, the following groups of recipients may have access to personal data: * hosting, infrastructure, and security service providers; * email, communication, maintenance, backup, and technical service providers; * service providers responsible for consent management, notifications, and the provision of the actually activated function; service providers; * statistical, marketing, or AI service providers, exclusively when the relevant function and legal basis exist; * accountants, legal representatives, insurers, authorities, or courts, if justified by a legal obligation or the enforcement of a claim. The basic data of the content management, form, customer, and customer service systems operating on the website may, as a general rule, be processed in a hosting environment under the service provider’s control; certain supplementary functions may utilize a separate service provider. Transfers outside the European Economic Area may only take place with appropriate safeguards in accordance with Chapter V of the GDPR. ## 14. Retention Periods | Data Category | General Retention Rule | | Server and Security Logs | For a short period commensurate with technical necessity, generally no longer than 30 days; in the event of an incident, until the investigation and claim resolution are concluded. | | Unsuccessful inquiries or requests for quotes | For a maximum of 6 months from the substantive closure of the inquiry, unless a legal claim, repeated contact, or separate consent justifies longer retention. | | Contractual and project-related communication | For the duration of the contract’s performance, followed by a period aligned with the statute of limitations for civil claims and evidentiary requirements. | | Business correspondence, invoices, and tax documents | 6, 8, or 10 years under German law, depending on the type of document. | | Customer service tickets | Generally 3 years after closure; in the case of contractual, billing, complaint, or legal dispute documentation, the longer statutory or claim enforcement period applies. | | Marketing or push notification consent | Until revoked; proof of consent may be retained for a limited period as necessary for the enforcement of legal claims. | | Statistical and marketing identifiers | For the duration specified in the Cookie Policy and the consent panel, or until consent is withdrawn. | | AI chat and AI summary | Session data for as long as technically necessary; case-related content in accordance with the retention rules for the specific case. | Upon expiration of the retention period, the data must be deleted or irreversibly anonymized, unless there is a further lawful basis for retention. ## 15. Rights of the Data Subject Under the terms of the GDPR, the following may be requested: * information and access to the processed data; * rectification of inaccurate data and completion of incomplete data; * erasure or restriction of processing; * data portability in the case of automated processing based on consent or a contract; * objection to processing based on Article 6(1)(f) of the GDPR; * withdrawal of consent with effect for the future; * request for human intervention if, under applicable law, an automated decision would affect you. The request may be sent to [hello@digiosveny.hu](https://digiosveny.hu/en/adatkezelesi-nyilatkozat/hello@digiosveny.hu). The data controller may request additional information proportionate to verifying the identity of the data subject and the validity of the request . ### Right to File a Complaint A complaint may be filed, in particular, with the authority competent for the data controller’s registered office: Authority: The State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate Visiting Address: Hintere Bleiche 34, 55116 Mainz, Germany Mailing Address P.O. Box 30 40, 55020 Mainz, Germany Phone +49 (0) 6131 8920-0 Email poststelle( at)datenschutz.rlp.de Website [https://www.datenschutz.rlp.de/](https://www.datenschutz.rlp.de/) The data subject may also contact another EU supervisory authority based on their usual place of residence, place of work, or the location of the alleged infringement. ## 16. Profiling and Automated Decision-Making Statistical or marketing systems based on consent may create pseudonymized interest or campaign profiles. Systems supporting administrative processes may categorize inquiries to ensure proper handling. Digiösvény does not use any fully automated decision-making that would have legal effects on the data subject or similarly significantly affect them. Offers, contracts, complaints, data protection requests, payment issues, and significant customer decisions are subject to human review. ## 16/A. Webinars: Registration, Participation, and Recordings Digiösvény offers online professional presentations via the WebinarPress-based webinar system, 15-minute “Just in Time” entry timing, a waiting room, and the option to watch recordings . Registration and participation take place on the central webinar page at digiosveny.hu ; the hello.digiosveny.hu interface may form part of the related customer journey. This process is not the same as booking an appointment via Amelia. **Data processed:** the name, email address, and message or question provided by the registrant; the selected event, registration and access status, date and time, confirmation and reminder delivery details; session and security data required for participation, the waiting room, and on-demand viewing (e.g., IP address, device/browser characteristics, access log). **Purpose and legal basis:** registration for the requested webinar, access, participation notifications, reminders, handling of questions, and provision of on-demand viewing: GDPR Article 6 (1)(b); technical protection and prevention of misuse: Article 6(1)(f) of the GDPR. The transactional email required for the event is not the same as a marketing newsletter; the latter requires a separate legal basis; if consent is given, it may be withdrawn. **Recording and External Video Service:** The recording of the presentation may be made available for viewing. A participant’s likeness, voice, name, or public comments do not automatically become part of the published recording; if such recording takes place, participants will be given separate prior notification. When using YouTube videos, personal or technical data may be transmitted to Google’s service; external embedded players, cookies, and analytics features that are not strictly necessary operate in accordance with applicable consent requirements, and in the case of transfers outside the EEA, safeguards in accordance with Chapter V of the GDPR are required. **Retention and Rights:** We process registration and participation data for the purpose of organizing the event, until the related administrative matters are concluded, or until a legal obligation or a justifiable legal claim exists, in a manner limited to the specified purpose. The retention of technical logs required for a short period is for security purposes. Data subjects’ rights and options for contacting us may be exercised in accordance with the relevant sections of this notice. Webinar Supplement: WEB-LEGAL-2026-10-16-v1 • Effective: October 16, 2026 • Previous provisions remain in full force and effect. ## 17. Amendments to This Notice and Related Documents This Privacy Policy may be amended if there are changes to the service, the technology used, the group of data processors, or legal requirements. The current version is available on this page, with the date of any material changes indicated. [Legal Notice](https://digiosveny.hu/impresszum/)[General Terms and Conditions](https://digiosveny.hu/aszf/) [Cookie Policy](https://digiosveny.hu/suti-tajekoztato/) Document version: PRIV-2026-08-10. This document must be reviewed in the event of material changes to the services, the technical system, or applicable law.