Privacy policy

Effective: the effective date will be added at go-live · Version: 1.0

1. The data controller

For any data protection question or request, reach me at [email protected]. I am not required to appoint a data protection officer, and I have not appointed one.

Data processing is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Hungarian Act CXII of 2011 on the right to informational self-determination and freedom of information (Infotv.); the use of cookies and similar technologies is additionally governed by Hungarian Act C of 2003 on electronic communications (Eht.) (see 3.1).

2. What data I handle, why, and for how long

The site presents services aimed at businesses; the forms are usually filled out by company representatives. Still, the data provided (name, email, phone number) counts as personal data, and I treat it as such.

2.1 Contact form and direct enquiries

This covers messages sent through the Contact page as well as enquiries that come in by email or phone.

• Data handled: name, email, the message text, phone number (only if you provide it, not a required field), the time of submission, and the source page.
• Purpose: to reply to your enquiry; for a quote request, to prepare the quote.
• Legal basis: your consent given on the form (GDPR Article 6(1)(a)); for a quote request, taking steps prior to entering into a contract (GDPR Article 6(1)(b)).
• Retention: 1 year after the matter is closed; if a collaboration starts, the rules for contractual data processing apply from then on (see 2.6).
• Where it goes: into my own client management system (CRM), which runs on Hetzner's EU server. Submitting the contact form does not add you to any newsletter or marketing list.

2.2 Free video audit form

Data from requests submitted on the free video audit page.

• Data handled: full name, email, website or Google Business Profile link (or company name), city; plus technical data recorded with the submission: the source tag (how you reached the site), the page language, the ad campaign parameters (utm_*), the state of your cookie settings, and a technical event identifier (see 3.3).
• Purpose: to prepare the video audit and send it by email, and, if you reply, further discussion: a consultation or a quote.
• Legal basis: taking steps at your request prior to entering into a contract (GDPR Article 6(1)(b)): preparing and sending the audit, and the related correspondence, is the delivery of a service you initiated. The form's required checkbox confirms your informed request; it is not a separate legal basis. This processing covers only the preparation and sending of the audit and the related correspondence, not marketing emails (those have a separate, optional checkbox and voluntary consent, see 2.3).
• Retention: until you withdraw your consent, but at most 2 years from the last meaningful contact; after that I delete or anonymise your data.
• Where it goes: into my own CRM system (Hetzner EU server).

2.3 Email tips and marketing emails

On the forms you can ask for further tips by email via a separate, unchecked-by-default checkbox. This consent covers a series of practical tips and occasional emails, such as a heads-up about a new article or case study.

• Data handled: name, email, the language of the emails, the source and time of sign-up, and delivery, open and click data for the emails.
• Legal basis: your consent given via a separate checkbox (GDPR Article 6(1)(a)). The checkbox is never pre-ticked, and the audit or contact works exactly the same without it.
• Unsubscribing: you can unsubscribe with one click at the bottom of every email. After that I send no marketing emails; I add your email to a suppression list and keep it there so you never get anything from me by mistake.
• Confirmation email: if you sign up some other way rather than together with an audit request, you first get a confirmation email, and the tip series only starts once you click the link in it.
• Retention: until you withdraw your consent (unsubscribe).

2.4 Technical data (server logs and first-party measurement)

While serving the website, the server automatically logs requests.

• Data handled: IP address, the address of the requested page, the time of the request, the browser type (user agent), the referring page (referrer), the response status code.
• Purpose: secure operation of the site, debugging, detecting abuse (such as attack attempts), and producing anonymised traffic statistics.
• Legal basis: I have a legitimate interest in running the site securely and reliably (GDPR Article 6(1)(f)). You can object to this as described in section 6.
• Retention: I keep the raw log files for at most 30 days, after which they are automatically deleted. The IP address and browser identifier (user agent) in the raw logs count as personal data and are processed on the legitimate-interest basis above; the traffic statistics derived from them are aggregated and do not contain individual visitors' IP addresses in any retrievable form. This logging uses no cookies or other device-side storage, so it does not require consent.

Alongside the server logs, and regardless of your cookie choice, a cookie-free, first-party event signal always runs. When a page loads, and when a form is submitted (a lead event), your browser sends a small signal to an endpoint on my own domain. This signal stores only the following: the path of the page, the HOST of the referring page, the page language, the name of the event, and a timestamp. It contains no IP address, no cookie, and no data that could identify you; it is stored in aggregate and is never passed to any third party.

• Legal basis: my legitimate interest in seeing, in aggregate, how the site is used and how many enquiries it produces, without tracking individual visitors (GDPR Article 6(1)(f)). You can object to this as described in section 6.

2.5 Consent records

Under the GDPR accountability principle, I keep a record of what you consented to, when, and with what wording.

• Data handled: the state of the checkboxes, the version of the consent text, the timestamp, the source page, and the state of your cookie settings (per 3.1).
• Legal basis: my legitimate interest in being able to prove afterwards that your consent existed and what it covered (GDPR Article 5(2) and Article 7(1)).
• Retention: 5 years after the given processing ends (the general limitation period under civil law).

2.6 If you become a client

I provide separate information about the data processing tied to contracting, delivery and invoicing when we sign a contract. I keep accounting documents (such as invoices) for 8 years, as required by the accounting act (legal basis: legal obligation, GDPR Article 6(1)(c)).

3. Cookies and tracking technologies

3.1 Cookie banner and managing your consent

On your first visit, a cookie banner appears with exactly two buttons of equal weight:

1. I accept: all measurement runs, that is both the statistics tag (Google Analytics 4) and the marketing tags (Meta Pixel and Google Ads).
2. Only essentials: no third-party measurement runs. Only the technologies essential to the site working stay active, including the record that stores your choice. No consent is needed for those.

There is no category-by-category toggle or slider: one decision covers statistics and marketing together. Choosing “Only essentials” is exactly as easy as choosing “I accept”, because the two buttons sit side by side with the same weight.

Storing and reading data on your browser or device (cookies and similar technologies), apart from the ones essential to the site working, requires your consent. Besides the GDPR, this is also required by Section 155 of Hungarian Act C of 2003 on electronic communications (Eht.). In the banner, the “I accept” and “Only essentials” buttons carry equal weight. If you choose “Only essentials”, you can use every function of the site just the same. By default every measurement is blocked. Until you decide, or if you choose “Only essentials”, none of the third-party measurement code (Google Analytics 4, the Meta Pixel and Google Ads) loads, and no data from it reaches Meta or Google; I use Google Consent Mode v2 so that without consent not even a so-called “cookieless ping” goes out. The cookie-free server logging and the first-party event signal needed for the operation and basic measurement of the site (2.4), which are not third-party code running in your browser and send no data to ad platforms, work on the legitimate-interest basis regardless of your cookie choice.

You can change or withdraw your choice at any time using the footer Cookie settings link. Your choice is stored in your browser's local storage (localStorage), not in a cookie. It stays until you change it with the footer link or clear your browser's stored data. There is no fixed expiry; if this policy changes materially, I ask for your consent again. When you submit a form, the current state of your cookie settings is sent to my CRM along with the submission, so I can guarantee on the server side too that no ad platform gets any data without consent.

3.2 Cookie table

Statistics and marketing cookies are only created after you consent to the relevant category.

3.3 Meta Pixel and Conversions API

If you have consented to the marketing category, the site runs the Meta Pixel, which sends page-view (PageView) and form-submission (Lead) events to Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland). For the data collected by the Pixel, Meta and I are joint controllers under GDPR Article 26. The joint controllership is based on the Meta Controller Addendum; in essence, responsibility is split so that I am responsible for embedding the Pixel on the site and for obtaining your consent needed for the measurement, while Meta is responsible for its further processing of the data for its own purposes. The Meta Controller Addendum setting out the substance of the arrangement is available at facebook.com/legal/controller_addendum, and Meta's own privacy policy at facebook.com/privacy/policy.

Alongside the browser-side measurement, and again only if you have consented to the marketing category, my server also reports the form submission to Meta via the Conversions API. In that case I transmit your email and (if you provided it) your phone number in irreversible hashed form, together with the Meta cookie identifiers (_fbp, _fbc). The browser-side and server-side reports get a shared technical event identifier (event_id), so Meta treats the two as a single event. The same submission is not counted twice. Without consent, neither the Pixel nor the Conversions API sends any data.

3.4 Google Ads and Google Analytics 4

If you have consented to the marketing category, the Google Ads tag sends a conversion event to Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) when you submit a form. For more accurate conversion measurement, I may also transmit your email to Google in irreversible hashed form (Enhanced Conversions). I store the ad click identifier (gclid) in a first-party cookie (see 3.2).

If you have consented to the statistics category, Google Analytics 4 measures how the site is used (pages viewed, traffic sources, device type). Here is how I have set it up: Google Signals (linking for advertising purposes) is turned off, data retention is set to the shortest option available at Google (2 months), and GA4 does not store the full IP address.

3.5 Data transfers outside the EU

Meta's and Google's European entities may pass on some of the data to their US parent companies (Meta Platforms, Inc., Google LLC). The basis for this is the EU–US data protection framework (EU–US Data Privacy Framework): both companies are certified participants, and the framework is recognised by an adequacy decision under GDPR Article 45. All your other data (forms, CRM, server logs) stays in the EU, on Hetzner's servers in Germany.

4. Processors and recipients

I do not sell your data, and beyond the above I do not pass it to third parties, unless required by law (for example, in response to an official request).

5. Data security

All communication between the site and the CRM system is encrypted (over HTTPS). Besides me, the CRM is accessed only by an authorised person acting on my instructions and on my behalf; access is password-protected and logged. The servers operate in the EU. I use no automated decision-making, and I do no profiling with legal effects.

6. Your rights

Under the GDPR you can exercise the following rights at any time:

• Access (Article 15): you can find out what data of yours I handle and request a copy of it.
• Rectification (Article 16): you can ask me to correct inaccurate data and complete incomplete data.
• Erasure (Article 17): you can ask me to delete your data, for example if you withdraw your consent and there is no other legal basis for the processing.
• Restriction (Article 18): you can ask me to restrict processing, for example while I check the accuracy of disputed data.
• Portability (Article 20): you can ask for the data I process based on your consent in a structured, machine-readable format.
• Objection (Article 21): you can object, on grounds relating to your particular situation, to processing based on legitimate interest (such as the server logging).
• Withdrawing consent (Article 7(3)): you can withdraw any consent at any time: for marketing emails via the unsubscribe link at the bottom of the email, for cookies via the Cookie settings link in the footer, and for everything else by email. Withdrawal does not affect the lawfulness of processing before it.

Send your request to [email protected]. I reply within one month; for a complex request I may extend the deadline by up to two more months, and I let you know within the first month. Handling requests is free, unless a request is clearly unfounded or repetitive.

7. Remedies

If you think the handling of your data breaches the GDPR, I ask you to raise it with me first, so I can sort it out as quickly as possible. Beyond that, you have the right to:

• lodge a complaint with the supervisory authority: the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9–11., email: [email protected], phone: +36 1 391 1400, web: www.naih.hu;
• go to court: you can also bring the case before the tribunal for your place of residence or place of stay.

8. Changes to this policy

I update this policy from time to time, for example if I add a new tool or a law changes. You will always find the current version on this page, together with the effective date and the version number. In the case of a material change, the cookie banner will ask for your consent again.

The site operator's official details can also be found in the legal notice .