Privacy

Privacy Policy

We collect only the data required to operate this website and to respond to your enquiries. This notice explains, in line with Art. 13 GDPR, what we process, on what legal basis, who receives it, and what rights you have.

1. Controller

The controller under the GDPR is: Cordata Consulting Kft., Máriássy utca 4., 8. em. 807. ajtó, 1095 Budapest, Hungary, represented by managing director László Hadházy. Company details are set out in the Legal Notice. For privacy matters, please contact [email protected].

2. Purposes and Legal Bases

We process personal data only for the purposes listed below and only where one of the following legal bases applies:

2.1 Website access

When you access the site, technically necessary connection data (IP address, timestamp, requested resource, HTTP status, user agent, referrer) is briefly processed by our CDN and hosting providers to deliver the site and keep it stable and secure. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in stable, attack-resilient operation).

2.2 Contact form and email

When you write to us via the contact form or by email ([email protected], [email protected]), we process your details to handle your request and to correspond with you. Legal basis: Art. 6 (1) (b) GDPR (steps prior to entering into a contract), or Art. 6 (1) (f) GDPR for general enquiries (legitimate interest in responding appropriately).

2.3 Bot protection (Cloudflare Turnstile)

To defend the contact form against automated abuse, we use Cloudflare Turnstile. Turnstile silently evaluates technical session signals (including IP address and browser characteristics) and sets a strictly functional cookie for that purpose only. Legal basis: Art. 6 (1) (f) GDPR (abuse prevention) and, for German visitors, § 25 (2) no. 2 TDDDG (strictly necessary storage — no consent required).

2.4 Analytics (self-hosted Plausible)

To improve the site we collect anonymous, aggregated usage statistics via Plausible Analytics, which we self-host in the EU on the same server, with no cookies, no cross-site tracking, and no sharing with third parties. We record page views, referrers, and the country derived from the IP address; the IP itself is discarded after processing. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in privacy-friendly reach measurement); § 25 (2) no. 2 TDDDG (strictly necessary processing).

3. Recipients, Processors, and Third-Country Transfers

We rely on carefully selected processors, each covered by a data processing agreement under Art. 28 GDPR. We do not transfer personal data to third parties for advertising or profiling. Concretely we use: Cloudflare, Inc. and Cloudflare Germany GmbH (CDN, DNS proxy, Turnstile bot protection) — for any transfers to the United States, Standard Contractual Clauses under Art. 46 (2) (c) GDPR are in place; Hetzner Online GmbH (Germany) — hosting of the website and backend services within the EU; no third-country transfer; Migadu SA, Switzerland — email hosting; Switzerland benefits from a European Commission adequacy decision under Art. 45 GDPR. Plausible Analytics is not operated by Plausible Insights OÜ but self-hosted by us on the same Hetzner server — no data is transferred to an analytics vendor.

4. Retention Periods

We retain personal data only for as long as the respective purpose requires. Server and access logs: up to 30 days, unless a security-relevant incident requires longer retention. Contact enquiries and email correspondence: until the matter is closed; business correspondence may be archived beyond that to comply with statutory retention obligations (in particular Hungarian commercial and tax law, typically eight years). Anonymous analytics data are aggregated and not tied to identifiable individuals.

5. Your Rights

You may, at any time, exercise the following rights with regard to your personal data: access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and objection to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR). Where processing is based on consent, you may withdraw that consent at any time with effect for the future. Please send requests to [email protected]; we usually respond within a few working days.

6. Right to Lodge a Complaint

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority for Cordata Consulting Kft. is the Hungarian Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa u. 9–11., Hungary — https://naih.hu. You may equally lodge a complaint with the authority in your country of habitual residence or workplace.

7. Cookies and Similar Technologies

This site uses no marketing or tracking cookies. The only exception is a strictly functional cookie set by Cloudflare Turnstile for abuse prevention on the contact form (see 2.3). Our self-hosted Plausible operates entirely without cookies. No consent is required for the Turnstile cookie under § 25 (2) no. 2 TDDDG.

8. No Automated Decision-Making

We do not use automated decision-making within the meaning of Art. 22 GDPR and do not carry out profiling.

9. Changes to this Notice

We update this notice when our processing activities or the legal framework change. The current version is always available on this page; the date of the last update is shown below.

Privacy contact: [email protected]

Last updated: July 2026