This English text is a courtesy translation. The legally binding version is the Hungarian one: Adatkezelesi tajekoztato. In case of any discrepancy, the Hungarian version prevails.
Legal notice
Privacy policy
Available at: https://siteflow.hu/adatkezelesi-tajekoztato/. Amendments to this policy take effect upon publication at the address above. Last updated: 24 October 2026.
Introduction
FIEDLER ATTILA (1191 Budapest, Kisfaludy utca 16. 10. em. 30., tax number: 59604273-1-43, company registration number/registration number: 57651444) (hereinafter: Service Provider, controller) agrees to be bound by the following policy: we provide the following information in accordance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (27 April 2016, General Data Protection Regulation, "GDPR") on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation 95/46/EC.
This privacy policy governs data processing on the following website: https://siteflow.hu/
The controller and contact details
Name: Fiedler Attila
Registered office: 1191 Budapest, Kisfaludy utca 16. 10. em. 30.
Email: info@siteflow.hu
Phone: +36 20 381 2463
Definitions
- "personal data": any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person;
- "processing": any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction;
- "controller": the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of processing personal data;
- "processor": a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller;
- "recipient": a natural or legal person, public authority, agency, or other body to which personal data is disclosed, whether or not a third party;
- "consent of the data subject": any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which the data subject, through a statement or clear affirmative action, signifies agreement to the processing of personal data relating to them;
- "personal data breach": a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed;
- "profiling": any form of automated processing of personal data involving the use of personal data to evaluate, analyze, or predict certain personal characteristics relating to a natural person.
Principles governing the processing of personal data
Personal data is processed in accordance with the following principles: lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality. The controller is responsible for complying with these principles and must be able to demonstrate such compliance ("accountability").
Data processing related to operating the service
1. The fact of data collection, categories of data processed, and purposes of processing
| Personal data | Purpose of processing | Legal basis for processing |
|---|---|---|
| First and last name | Contact, identification, providing a quote, and entering into a contract. | Article 6(1)(b) of the GDPR (performance of a contract or taking steps before entering into a contract). |
| Email address | Primary communication channel, sending quotes, contracts, invoices, and other project documents. | Article 6(1)(b) of the GDPR. |
| Phone number | Secondary communication, discussing urgent matters or issues requiring quick coordination regarding the project or contract. | Article 6(1)(b) of the GDPR. |
| Billing name and address | Issuing legally compliant invoices, creating and administering the contract, and enforcing claims arising from it. | Article 6(1)(c) of the GDPR (compliance with a legal obligation under Act C of 2000 on Accounting). |
| IP address used when visiting the website | Ensuring the technical operation of the service, IT security, and detecting and preventing attacks against and misuse of the website. | Section 13/A (3) of Act CVIII of 2001 on Electronic Commerce Services (Elker tv.). |
Categories of data subjects: website visitors, people requesting quotes, and clients using the service.
Duration of processing and deadline for deleting data: the Service Provider retains data submitted through the website's forms (contact, quote request) for 365 days from submission and then deletes it automatically, unless the data subject requests deletion earlier or the data results in a contract/invoice. If any of the conditions set out in Article 17(1) of the GDPR applies, processing continues until the data subject requests deletion. Accounting records are an exception, as this data must be retained for 8 years under Section 169 (2) of Act C of 2000 on Accounting. The data subject's contractual data may be deleted at the data subject's request after the civil-law limitation period expires.
Persons authorized to access the data: personal data may be processed by the controller and its authorized staff.
Rights of data subjects: the data subject may request access to, correction, deletion, or restriction of processing of personal data relating to them from the controller and has the right to data portability and to withdraw consent at any time. This may be done by mail (1191 Budapest, Kisfaludy utca 16. 10. em. 30.), email (info@siteflow.hu), or phone (+36 20 381 2463).
Legal basis for processing: Article 6(1)(b) of the GDPR; Section 13/A (3) of the Elker tv.; for invoicing under accounting laws, Article 6(1)(c) of the GDPR; for enforcing claims arising from a contract, the 5-year limitation period under Section 6:22 of the Civil Code (Act V of 2013).
Processing is necessary to perform the contract and provide a quote. Providing personal data is mandatory for performing the contract; without it, handling the inquiry and providing the service is not possible.
Cookie management
Prior consent is not required for the use of "necessary" and "security" cookies because they are essential to the website's basic operation. In contrast, using "functional" and "statistical" cookies requires your express prior consent, which is managed through the cookie settings panel displayed on the website.
Categories of data processed: unique identification number, dates, times. Categories of data subjects: all data subjects who visit the website.
| Cookie type | Legal basis for processing | Duration of processing |
|---|---|---|
| Session cookies and other cookies strictly necessary for the website to function | Section 13/A (3) of the Elker tv. | Until the browser is closed. |
| Statistical and marketing cookies | Article 6(1)(a) of the GDPR. | 1 day – 2 years, or until consent is withdrawn. |
Reminder for returning visitors: the first-party sf_folytat cookie. If a visitor returns to the quote page after completing the questionnaire, a bar reminds them of their personalised preview and offers a button to open it; once the preview has been opened, the bar also shows how many more days it is available. After payment, the bar links to their project page. The cookie stores only a random identifier, not the preview link; the server links this identifier to the records of the person who completed the questionnaire (name, email address, preview page), so the cookie counts as personal data. It is not used for advertising or audience building. Each display of the bar and each click on its button is recorded only in Google Analytics 4, without name, email address or identifier; these events are not stored in our own event log. | Article 6(1)(a) of the GDPR (consent): it is set only after the “Statistics” category has been accepted in the cookie banner. Consent can be withdrawn at any time in the cookie settings or with the bar’s “Don’t show this again” button; this switches off only the reminder and does not affect any other statistics consent. On withdrawal both the cookie and the related server-side record are deleted. | Until the preview expires (14 days by default; if the preview is extended on request, until the extended expiry date), including after payment, or until consent is withdrawn. |
Rights of data subjects: consent to non-essential cookies may be changed or withdrawn at any time through the cookie settings panel displayed on the website. Cookies can also be deleted manually from the browser's Tools/Settings menu.
Browser-specific settings: Google Chrome · Microsoft Edge · Mozilla Firefox · Apple Safari
Use of Google Ads conversion tracking
This section concerns data processing planned by the Service Provider for the future—the processing described here will not take place until tracking is actually implemented.
The controller plans to use the "Google Ads" online advertising program, including Google's conversion tracking service (Google Ireland Limited, Ireland, and its parent company Google LLC, USA). When a User reaches the website through a Google ad, a cookie required for conversion tracking is placed on their computer. Each Google Ads client receives a different cookie, so Users cannot be tracked across client websites. The information is used to compile conversion statistics—the controller does not receive data that can directly identify the User, such as a name or email address.
Under Google Consent Mode v2, the ad_user_data and ad_personalization cookie types are based on the data subject's consent; the controller ensures that the appropriate consent can be given and withdrawn through its cookie banner. Consent may be withdrawn at any time through the cookie settings panel; this does not affect the lawfulness of processing carried out before consent was withdrawn. More information: https://policies.google.com/privacy
Use of Google Analytics
This section concerns data processing planned by the Service Provider for the future—the processing described here will not take place until tracking is actually implemented.
The website plans to use the Google Analytics web analytics service in the future (Google Ireland Limited, Ireland, and its parent company Google LLC, USA), which uses cookies to analyze website usage. The legal basis for using the service is your freely given prior consent, which you may give or withdraw at any time through the cookie settings panel. You can also prevent cookies from being stored through your browser settings; in that case, some website features may not be fully available.
If Google Ads and Google Analytics services are activated, data may also be transferred to Google LLC, based in the USA. The legal basis for such transfers is the European Commission's adequacy decision (EU–US Data Privacy Framework, "Data Privacy Framework"), details of which are available at: https://www.dataprivacyframework.gov/. The controller notes that the validity of this legal basis may be affected by international court proceedings; current status information is available on the website above and through notices issued by the NAIH.
Monthly-fee website — starting questionnaire and preview page
A short questionnaire can be completed on the website, and based on it the system uses artificial intelligence to create a preview (demo) home page for the business. Completing the questionnaire is free of charge and does not commit the data subject to anything.
If the editor mode is available on the preview (demo) page, the data subject can replace its images with their own photos, with an image generated by artificial intelligence from their own description, or with a sample image.
| Personal data | Purpose of processing | Legal basis for processing |
|---|---|---|
| Name, email address, phone number (if provided) | Identification, contact, and sending the link to the preview page. | Article 6(1)(b) of the GDPR (steps taken at the data subject's request before entering into a contract). |
| The answers to the questionnaire: the name of the business, its activity, its clientele, its services, the subpages requested, the form of address, and the chosen style, typeface and brand colour | Creating the text and the design of the preview page. The answers are transferred to OpenAI Ireland Limited (Dublin, Ireland), which processes them in the systems of OpenAI, L.L.C. (United States of America); the safeguard for the transfer is the standard contractual clauses (SCC) under Commission Implementing Decision (EU) 2021/914. Under its current contractual terms, the provider does not use data passed through the API to train its models. To create the images of the preview page, the system compiles an image description from the short description of the business activity and transfers it to Google Ireland Limited (Dublin, Ireland; Gemini API); this image description contains no personal data and expressly excludes the depiction of people. An image description written by the data subject is covered by the “AI image on the preview page” row below. | Article 6(1)(b) of the GDPR. |
| The text of a change requested on the preview page (what the data subject would like to be different in the text or an image of the preview page) | Revising the text or an image of the preview page. Requests concerning the text are transferred to OpenAI, and requests concerning an image to Google Ireland Limited, under the same conditions as above. The previous version is kept for one step, so that the data subject can restore it. | Article 6(1)(b) of the GDPR. |
| “Ask for anything” request (a free-text request of 3–500 characters typed at the top of the editor panel), with its identifier, time and outcome (can or cannot be carried out, with a reason code) | Interpreting the request and preparing a proposed change to the preview page (a preview) from the editor's existing operations; where the request asks for text to be rewritten, writing the new text. The request first passes the automated content filtering described below, and is then transferred for interpretation and, where text is to be rewritten, for writing the text to OpenAI Ireland Limited, with the safeguards described for this processor (SCC); under its current terms the provider does not use data submitted through the API to train its models and may retain it for up to 30 days for abuse monitoring. If the proposal includes an AI image, the image description compiled from the request is sent, after the data subject approves it, to Google Ireland Limited as described in the “AI image on the preview page” row. The system only makes a proposal: the preview page changes only after the data subject approves it, the change can be undone, and the system does not take any decision based solely on automated processing that produces legal effects concerning the data subject (Article 22 of the GDPR). The request does not need to, and should not, contain personal data (names, contact details, data about another person). If the content filter flags the request, it is not carried out and none of its text is kept. The text of the request is stored with the data of the preview page; the controller's internal event log records only its length and technical outcome (reason code), not its text. If an order is placed, the text of requests that could not be carried out on the preview (up to 500 characters each, marked as the data subject's own words) is added to the preview state recorded at the time of the order and to the “Anything else I should know” field of the detailed brief, so that they can be discussed when the Website is built; the data subject can edit or delete this field when completing the brief. | Article 6(1)(b) of the GDPR (steps taken at the data subject's request before entering into a contract, or performance of the contract); for content filtering, Article 6(1)(f) of the GDPR (the controller's legitimate interest in preventing unlawful content or content that breaches the terms of use, as established by a balancing test, which is available on request at info@siteflow.hu; the data subject may object to this processing at any time under Article 21 of the GDPR). |
| Uploaded photo on the preview page (a photo uploaded on the Images tab of the editor): the image itself, which is personal data if an identifiable person (the uploader or someone else) appears in it; the image spot, the image size, the time of upload and the SHA-256 hash of the image | Showing the photo on the data subject's preview page and, if an order is placed, building the Website (the photo is also added to the "Own photos" field of the detailed brief). On upload the system re-encodes the photo and reduces it to at most 1600 pixels; hidden data embedded in the file (such as the location where it was taken or camera details) is removed at this point, and no copy of the original file is kept. No facial recognition or other biometric identification is carried out. Photos are stored in a folder with a non-guessable name and are not indexed by search engines. Own photos are not transferred to the image-generation provider (Google). | For the uploader: Article 6(1)(b) of the GDPR (steps taken at the data subject's request before entering into a contract, or performance of the contract). For any other person shown in the photo: Article 6(1)(f) of the GDPR (the legitimate interest of the controller and the uploader in producing the requested preview or website), having regard to the uploader's declaration that the person shown has consented to such use of their image (Section 2:48 of the Hungarian Civil Code), as established by a balancing test, which is available on request at info@siteflow.hu; the data subject may object to this processing at any time under Article 21 of the GDPR. |
| Automated content filtering: a copy of the uploaded photo, reduced to at most 512 pixels and without hidden data; the AI image generated on the preview page; the text of the image description written by the data subject; the text of a request typed in the “Ask for anything” field, and the text and image description proposed in response | Preventing sexual, violent or self-harm content from being placed on the preview page. The copy and the description are transferred to the content filtering (moderation) service of OpenAI Ireland Limited, with the safeguards described for this processor (SCC); under its current terms the provider does not retain data sent to the moderation service and does not use it to train its models. If the filter flags the image, or is unavailable, the image is not uploaded and the file is deleted immediately; a sample image or an AI image can be chosen instead, and the decision can be contested at info@siteflow.hu. The “Ask for anything” request and the proposal made in response are checked in the same way; if the filter flags them or is unavailable, the request or the affected part of the proposal is not carried out. The controller receives a daily internal summary of new photos uploaded to preview pages (the name of the preview's owner and the number of photos), may review the images on its own interface, and removes unlawful images (General Terms, clause 11.9). | Article 6(1)(f) of the GDPR (the controller's legitimate interest in not storing unlawful content or content that breaches the terms of use, as established by a balancing test, which is available on request at info@siteflow.hu; the data subject may object to this processing at any time under Article 21 of the GDPR). |
| AI image on the preview page: the image description written by the data subject on the Images tab (up to 300 characters) | Generating an AI image for the selected spot of the preview page. The system transfers the description, together with the basic description of the image spot and the image restrictions (no identifiable person, no brand marks or lettering; people only in a way that makes them unrecognisable), to Google Ireland Limited (Gemini API), with the safeguards described for this processor; before that, the description also passes the content filtering described above. As the description is written by the data subject, it does not need to, and should not, contain personal data (names, contact details, a description of another person). The finished AI image does not depict an identifiable person and is shown labelled as generated by artificial intelligence. | Article 6(1)(b) of the GDPR. |
| Declaration for an uploaded photo: the version of the declaration text, the version of the accepted General Terms, the time it was made and the IP address, the identifiers of the preview page and the image spot, and the SHA-256 hash of the image | Being able to prove afterwards that the uploader made the declaration on the use of the image (right to use it, consent of the person shown). | Article 6(1)(f) of the GDPR (the controller's legitimate interest in being able to prove legal declarations). |
| Data of an unfinished questionnaire: the name and email address given at the end of the first step, and the answers given up to that point, saved on the server at each step forward. Data is stored only after the data protection checkbox has been ticked: without it, the system saves no answers at all. | Making it possible to continue the questionnaire later (an unfinished questionnaire can be continued at any time through a unique link). | Article 6(1)(b) of the GDPR (steps taken at the data subject's request before entering into a contract). |
| Use of the email address for informational emails about the requested service: one email with the link to continue, if the data subject leaves the questionnaire unfinished (one hour after leaving it); one email about the date on which the unfinished answers will be deleted (on the 14th day from starting the questionnaire); one email with the link to the finished preview page; one email before the 14-day availability of the preview page expires; and one email if the data subject started an order but the set-up fee was not paid (at most one per order, after the payment was interrupted or the payment session expired) | Making the requested service (the preview page) available and providing information about it. These emails contain no advertising. | Article 6(1)(b) of the GDPR (steps taken at the data subject's request before entering into a contract). Every email contains a one-click unsubscribe option; after unsubscribing, no such email is sent either. |
| Use of the email address for reminder and informational emails (the preview page, prices, how ordering works, frequently asked questions, completed work): for an unfinished questionnaire, at most four emails within 14 days; for a finished preview page that has not been ordered, at most four emails within 8 days; at most one per day | Providing the information needed for a decision and promoting the service (commercial advertising). | Article 6(1)(a) of the GDPR (consent) and Section 6(1) of Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities — consent given on the questionnaire with a checkbox that is separate from the data protection checkbox and not pre-ticked, or with a separate button on the preview page; the time and source of the consent are recorded. Giving consent is not a condition of completing the questionnaire or viewing the preview page, and it can be withdrawn with one click in every email. |
| The number of times the preview page was opened and the time it was last opened, the fact that payment was started, and the answers to the questionnaire | The controller's internal daily to-do list of who viewed their preview page and who might benefit from personal help with the decision. If the data subject has consented to the reminder and informational emails above, the system may also prepare a draft of a short, personal follow-up email based on the answers to the questionnaire; for this, the answers are transferred to OpenAI Ireland Limited under the same conditions as above. The system does not send the draft: the controller checks it and decides itself whether to send it. Without consent, the controller does not contact the data subject for advertising purposes on the basis of the to-do list; in that case, it only makes contact at the data subject's request or in connection with an order in progress. | For the to-do list, Article 6(1)(f) of the GDPR (the controller's legitimate interest in serving prospective clients, as established by a balancing test, which is available on request at info@siteflow.hu; the data subject may object to this processing at any time under Article 21 of the GDPR); for the follow-up email, the consent described above under Article 6(1)(a) of the GDPR and Section 6(1) of Act XLVIII of 2008. The data is deleted together with the questionnaire data, within the time limits set out below. |
| Comparative measurement of the preview page editor: the measurement group (editor group or comparison group) and the language of the preview page; a one-way pseudonymised code derived from the email address with a secret key; data already held in the system about the use of the preview page and the editor (opening the preview page and the editor, the features used, the number of saves and of operations performed with artificial intelligence, and the fact and time of accepting the agreement, paying the set-up fee and withdrawing). Text typed in the editor, uploaded images and the IP address are not included. | Determining whether the editor mode of the preview page helps prospective clients make their decision. During the measurement, the system assigns preview pages to two groups, in a lottery-like manner, on the basis of the code derived from the email address: in one group the editor mode is available on the preview page, while the other group receives the preview page in its earlier form without the editor. The same email address is always assigned to the same group. The service that can be ordered, its price and its terms are the same in both groups; the assignment produces no legal effects concerning the data subject, and the system takes no decision about it based solely on automated processing (Article 22 of the GDPR). When the preview page is closed for the measurement (if no order is placed, at the latest before the questionnaire data is deleted; if an order is placed, no earlier than 15 days after the set-up fee is paid), the system creates a summary row that contains no client identifier, name, email address, IP address or exact date — only the group, the language, the week in which the questionnaire was completed, yes/no indicators and banded counts; the controller uses these rows solely for aggregate, group-level statistics and not for decisions concerning any individual. If the data subject has consented to the “Statistics” category, the group label is also sent to Google Analytics 4 when the preview page is viewed, without any identifier (see “Use of Google Analytics”). The data is not disclosed to any other recipient. | Article 6(1)(f) of the GDPR (the controller's legitimate interest in measuring whether a new feature of its service actually helps prospective clients, as established by a balancing test, which is available on request at info@siteflow.hu; the data subject may object to this processing at any time under Article 21 of the GDPR). The use for statistical purposes is subject to the safeguards required by Article 5(1)(b) and Article 89(1) of the GDPR (pseudonymisation, data minimisation, banded counts). For the group label sent to Google Analytics 4, Article 6(1)(a) of the GDPR (consent). |
The identifier and expiry of the return reminder (the sf_folytat cookie) | A reminder that the preview page (after payment, the project page) is available, if the data subject returns to the questionnaire page. The controller does not use it for follow-up. | Article 6(1)(a) of the GDPR — consent given to the “Statistics” category of the cookie banner. It is deleted when consent is withdrawn, and no later than when the preview expires. |
| The content of the finished preview page and its unique link | Making the preview page available to the data subject. The preview page can be accessed only with the unique link and is not indexed by search engines. | Article 6(1)(b) of the GDPR. |
| IP address, the time of completing the questionnaire and of ticking the checkboxes | Filtering out abusive and automated submissions and keeping the system secure; and recording the fact and time of giving consent so that it can be proved afterwards. | Article 6(1)(f) of the GDPR (the controller's legitimate interest in preventing abuse of the service, as established by a balancing test), and the record required by Article 7(1) of the GDPR and Section 6(5) of Act XLVIII of 2008. The data subject may object at any time under Article 21 of the GDPR, at info@siteflow.hu, to processing based on legitimate interest; the balancing test is available on request at the same address. |
| The client's details when ordering: name or company name, registered office or home address, tax number, company registration number or other registration number, the name and position of the representative, the type of client (company, sole trader, other organisation, private individual) and, for a company or other organisation, the declaration of authority to represent it | Identifying the contracting parties in the agreement, establishing whether the client is a consumer, and issuing a legally compliant invoice. | Article 6(1)(b) of the GDPR (entering into and performing the contract); for the invoice, Article 6(1)(c) (Act C of 2000 on Accounting). |
| Acceptance of the agreement when ordering: the full text of the accepted agreement and its SHA-256 hash, the version and hash of the accepted General Terms, the name typed in, the email address, the time of acceptance, the IP address and the browser identifier | Being able to prove afterwards that the agreement was concluded and what it contained; sending a copy of the accepted agreement and General Terms after payment. | Article 6(1)(b) of the GDPR (entering into the contract); for proof, Article 6(1)(f) (the controller's legitimate interest). Retention: 5 years from the end of the contract (the general limitation period under the Civil Code); if the set-up fee is not paid, the contract is not concluded, and the acceptance data is deleted after 90 days. |
Categories of data subjects: every natural person who starts or completes the starting questionnaire (including people who use the preview page editor), and any other identifiable natural person shown in a photo uploaded to the preview page. Consequence of not providing the data: the name and email address are needed to create and deliver the preview page, and the questionnaire cannot be submitted without them; providing a phone number is optional.
Duration of processing: the system automatically deletes the data of an unfinished questionnaire — together with the IP address and the timestamp — 30 days after the questionnaire was started. If no contract is concluded, the system automatically deletes the answers to a completed questionnaire and the name and email address provided 90 days after completion. The preview page created from a completed questionnaire is available for 14 days after it is created, and is then deleted. If a contract is concluded with the data subject, the contract-related data is retained for the periods that apply to contract data: invoices and the supporting documents for 8 years (Section 169(2) of Act C of 2000 on Accounting), and the other contract-related data and the log of legal declarations for 5 years, the general limitation period under the Civil Code.
Retention: if no order is placed, own photos and AI images are deleted automatically when the preview expires, and no later than 30 days after expiry. The data subject can delete an own photo immediately at any time with the "Delete" button on the Images tab; the file is then also removed from earlier versions. The "Back to the original" button does not delete the photo, it only resets the image spot, so the photo can still be restored from History. If an order is placed, the images recorded on the preview become part of the project materials (own photos are also added to the "Own photos" field of the detailed brief); their copy available on the preview page is deleted 90 days after the contract ends (cancellation, withdrawal or the end of the term), and the copy stored in the project is kept for building and operating the Website for the term of the contract, and then for 90 days after the contract ends. Under its current terms, OpenAI does not retain the copy sent for content filtering. The declaration log is deleted together with the questionnaire data (90 days after completion) if no order is placed, or 5 years after the contract ends if an order is placed.
Retention of “Ask for anything” requests: if no order is placed, the text of requests is deleted automatically together with the other data of the preview page when the preview expires, and no later than 30 days after expiry. If an order is placed, requests stored with the preview are deleted 90 days after the contract ends; requests that could not be carried out and were added to the detailed brief are deleted together with the other brief data, within the periods that apply to the contract. Under its current terms, OpenAI may retain a processed request for up to 30 days; it does not retain text sent for content filtering.
Duration of the comparative measurement of the editor, and objection: the group assignment and the usage data in the event log are deleted together with the questionnaire data, within the time limits set out in the “Duration of processing” paragraph of this section. The codes derived from email addresses and the secret key used to create them are deleted 90 days after the measurement is closed. Summary rows are kept for 1 year after the measurement is closed, but no longer than 2 years after the row was created, and are then deleted automatically. The data subject may object to the measurement at any time at info@siteflow.hu: in that case their preview page is excluded from the measurement and no summary row is created for it; this does not change how the preview page works or the terms of ordering. A summary row that has already been created contains no identifier that could be linked to the data subject, so the rights under Articles 15–20 of the GDPR apply to it only if the data subject provides additional information enabling their identification (Article 11(2) of the GDPR).
Rights of the person shown and how to request deletion: The controller does not inform any other person shown in a photo directly, because their contact details are not available to it (Article 14(5)(b) of the GDPR); instead, the controller makes this information publicly available in this notice. Anyone who sees their own image on a preview page without having consented to it can request its removal and deletion at info@siteflow.hu; it is enough to give the link of the preview page or a short description of the image, and the requester's contact details. After checking the request, the controller removes the image without undue delay and informs both the requester and the uploader. Any other image considered unlawful can be reported at the same address (General Terms, clause 11.9).
Messages on the project page and in the question window of the preview page: the data subject and the controller can exchange written messages on the project's page, which is accessible through a unique link. Data processed: the text of the messages, their sender, their time and whether they have been read. Purpose: keeping in contact and performing the contract; legal basis: Article 6(1)(b) of the GDPR. The other party is notified of a new message by email. Questions asked in the “Have a question?” window of the preview page before the set-up fee is paid (the text and time of the question) also go into the same conversation, and the controller answers them on its own interface; their legal basis is Article 6(1)(b) of the GDPR (steps taken at the data subject's request before entering into a contract). If no contract is concluded, questions asked before payment are deleted together with the other data of the enquiry, within the time limit set out in the “Duration of processing” paragraph of this section. If the controller requests a translation of a message or a reply draft, or if the system prepares a reply draft for unanswered messages in the controller's daily internal summary, the conversation, the brief and the text of the preview page are transferred to OpenAI Ireland Limited under the conditions set out above; the system does not send anything to the data subject on its own — the controller checks and sends every reply, and the system makes no decision based solely on automated processing that produces legal effects concerning the data subject (Article 22 of the GDPR). Messages are retained for 5 years from the end of the contract (the general limitation period under the Civil Code).
Unsubscribing and withdrawing consent: at the bottom of every reminder email there is a one-click unsubscribe link, which stops the emails immediately; unsubscribing can also be requested at info@siteflow.hu and at the controller's postal address (see “The controller and contact details”). Withdrawing consent does not affect the lawfulness of processing before the withdrawal. If the data subject asks for the stored answers to be deleted, the controller deletes them without delay.
Complaint handling
| Personal data | Purpose of processing | Legal basis for processing |
|---|---|---|
| First and last name, email address, phone number | Identification and communication. | Article 6(1)(b) of the GDPR. |
| Billing name and address | Identification and handling quality complaints, questions, and problems related to the service provided. | Article 6(1)(b) of the GDPR. |
Categories of data subjects: all data subjects who use the service and raise a quality concern or submit a complaint. Duration of processing: copies of the complaint record, transcript, and response must be retained until the end of the general limitation period under the Civil Code (5 years).
Recipients to whom personal data is disclosed
Processors
To support its own processing activities and fulfill its obligations under contracts with data subjects and applicable laws, the controller uses the following processors:
| Processing activity | Name of processor | Contact details |
|---|---|---|
| Hosting services | Sybell Informatika Kft. | 1138 Budapest, Tomori utca 34. 2. emelet, hello@sybell.hu |
| Online invoicing | Billingo Technologies Zrt. | 1133 Budapest, Árbóc utca 6. III. emelet, hello@billingo.hu |
| Artificial intelligence: preparing and revising the text of the preview page, interpreting requests typed in the “Ask for anything” field of the preview page, translating messages, producing reply drafts (project messages, incoming emails) and follow-up email drafts, answers of the companion (chat window), briefing summaries and notes for calls; automated content filtering (moderation) of photos uploaded to the preview page, AI images generated on it, image descriptions and “Ask for anything” requests | OpenAI Ireland Limited (transfer to OpenAI, L.L.C., USA) | 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland — standard contractual clauses under Commission Decision (EU) 2021/914, a copy of which can be requested at info@siteflow.hu; privacy policy |
| Artificial intelligence: creating and revising the image of the preview page (from a short description of the business activity, from the data subject's image change request, from an image description written by the data subject on the Images tab, or from an image description compiled from an “Ask for anything” request and approved by the data subject) | Google Ireland Limited (Gemini API; transfer to Google LLC, USA) | Gordon House, Barrow Street, Dublin 4, Ireland — transfers to Google LLC are safeguarded by its EU–US Data Privacy Framework (DPF) certification, with standard contractual clauses (SCC) as a fallback |
| Web analytics (planned, currently inactive) | Google Ireland Ltd. / Google LLC | Gordon House, Barrow Street, Dublin 4, Ireland |
Social media
The fact of data collection, categories of data processed: the name registered on Facebook and LinkedIn and the user's public profile picture. Categories of data subjects: all data subjects registered on Facebook or LinkedIn who have "liked"/followed the Service Provider's social media page or contacted the controller through it. Purpose of data collection: sharing and promoting the website's content and services. Legal basis for processing: the data subject's freely given consent.
Joint processing by Facebook / Meta
The controller maintains a Facebook/Meta profile for its business activities. Processing for statistical purposes on Facebook is carried out jointly by the controller and Facebook Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland); details are provided in the Page Insights Controller Addendum: https://www.facebook.com/legal/terms/page_controller_addendum. The controller communicates by private message on social media only if you contact it there. Processing continues until consent is withdrawn or, for message exchanges, for no more than 2 years.
Client relationships and other processing
If you have a question or encounter a problem while using the service, you may contact the controller through the methods listed on the website (phone, email, social media). The controller deletes received emails, messages, and personal data voluntarily provided in them no later than 2 years after the data is provided, unless the matter results in a contract or another legal basis requires a longer retention period, such as complaint handling or invoicing.
AI-assisted reply drafts for emails sent to info@siteflow.hu: incoming emails are reviewed by a program running on the controller's own computer. Newsletters, automatic replies and system notifications are filtered out based on their headers, and their content is not transferred. For all other emails, the sender's name and email address, the subject and text of the email, the earlier quoted part of the conversation and — if the sender is a client or prospective client of the controller — the related records held about them (name, company name, the status of their order or proposal) are transferred to OpenAI Ireland Limited (Dublin, Ireland), which processes them in the systems of OpenAI, L.L.C. (United States of America); the transfer is safeguarded by the standard contractual clauses under Commission Implementing Decision (EU) 2021/914, and under its terms of service the provider does not use data submitted through its API to train its models. Purpose: classifying the email and preparing a reply draft, which the program saves among the drafts of the controller's mailbox. The program sends nothing: every reply is checked, edited where necessary and sent by the controller personally; the program only classifies emails and takes no decision based solely on automated processing that produces legal or similarly significant effects for the data subject (Article 22 GDPR). The data subjects concerned include third parties named in the email. Please do not send special categories of personal data (such as health data) by email. Legal basis: where the email is a pre-contractual enquiry or relates to an existing contract, Article 6(1)(b) GDPR; otherwise Article 6(1)(f) GDPR (the controller's legitimate interest in answering enquiries quickly and accurately, based on a balancing test). You may object to processing based on legitimate interest at any time under Article 21 GDPR by writing to info@siteflow.hu, after which the program skips your emails. The internal log of the processing (sender, subject, a one-sentence summary) is deleted after 45 days; the email itself and the reply fall under the retention period of up to 2 years described above.
Companion (chat window) on the ordering pages: on the pages of the website related to ordering, an automated assistant based on artificial intelligence answers visitors' questions; this is indicated in the header of the chat window. The questions typed in and the last 12 turns of the conversation at most are transferred to OpenAI Ireland Limited to prepare the answer, under the conditions and safeguards described above for AI-assisted reply drafts. The conversation is not stored on the server: it exists only in the visitor's browser until the page is closed. To prevent excessive or abusive use, a pseudonymised identifier derived from the IP address is stored for up to 1 hour, and a daily aggregate count containing no personal data is kept. If the visitor asks for the question to be forwarded to Attila Fiedler, they provide their email address; the email address and the conversation are then sent by email to info@siteflow.hu and fall under the retention period of up to 2 years described above. Legal basis: for answering questions, Article 6(1)(f) GDPR (the controller's legitimate interest in answering visitors' questions immediately, based on a balancing test that can be requested at info@siteflow.hu and against which the data subject may object at any time under Article 21 GDPR); for pre-contractual questions and for forwarding, Article 6(1)(b) GDPR (steps taken at the data subject's request); for storing the pseudonymised IP identifier, Article 6(1)(f) GDPR (the controller's legitimate interest in preventing abusive use of the service). The companion takes no decision based solely on automated processing that produces legal or similarly significant effects for the data subject (Article 22 GDPR). Please do not enter more personal data in the chat than your question requires, and no special categories of personal data (such as health data) at all.
Booking a 20-minute call (siteflow.hu/idopont) and preparing the call
On the website's booking page, visitors can book a 20-minute conversation with the controller. Data processed: name, company name (optional), phone number, email address, the note on what they would like to discuss, and the chosen time slot. Purpose: arranging and holding the call, confirming the booking by email and recording it in the controller's client records; legal basis: Article 6(1)(b) GDPR (steps taken at the data subject's request prior to entering into a contract). To prevent the same slot from being booked twice, the email address and the booking time are stored on the server in a lock file for the booked slot, which is deleted automatically on the 14th day after the call.
Preparing the call with artificial intelligence: before the call, the booking data and — if the person is a prospective or existing client — the records held about them (answers to the questionnaire and the brief, the status of the order or proposal) are transferred to OpenAI Ireland Limited, under the conditions and safeguards described above for AI-assisted reply drafts, to prepare a briefing summary that is placed in the controller's own mailbox (legal basis: Article 6(1)(f) GDPR, the controller's legitimate interest in holding a well-prepared call; the balancing test can be requested at info@siteflow.hu, and you may object under Article 21 GDPR). After the call, the controller's own notes are processed in the same way to produce organised notes and, where needed, a follow-up email draft relating to the proposal requested or the next step agreed in the call, which the program does not send: the controller checks it and sends it personally (legal basis: Article 6(1)(b) GDPR). The copy of the notes on the controller's computer is deleted after 45 days; the emails about the booking, the briefing and the call fall under the retention period of up to 2 years described in "Client relationships and other processing". No decision based solely on automated processing that produces legal or similarly significant effects is taken (Article 22 GDPR). Without the name, phone number and email address the booking cannot be submitted; the company name and the note are optional.
Partner program—data collection through intermediary referrals
The controller operates a partner program under which contracted intermediary partners may provide the controller with the contact details (name, company name, phone number, email address) of potential clients interested in website development services. Categories of data subjects: all potential clients whose data is provided to the controller by an intermediary partner. Purpose of processing: making contact and providing a quote. Legal basis for processing: the data subject's consent (Article 6(1)(a) of the GDPR), or the legitimate interests of the controller and the partner in offering the service (Article 6(1)(f) of the GDPR).
Joint processing: during the stages of identifying potential clients, making initial contact, and transferring data, the controller and the intermediary partner are joint controllers under Article 26 of the GDPR because the controller determines the target client group and the content of the outreach, while the partner makes the actual contact independently using its own resources. For all subsequent processing after the data is received (providing a quote, entering into a contract, performance, invoicing), the controller acts as an independent controller. The information required under Article 13 of the GDPR is provided primarily by the intermediary partner when the data is collected. Under Article 26(3) of the GDPR, you may exercise your rights against either controller—the controller's contact details are provided at the beginning of this policy.
Duration of processing: if the quote does not result in a contract, the controller deletes the data received from the intermediary partner after no more than 365 days.
Rights of data subjects
- Right of access: you may obtain confirmation of whether your data is being processed and access the data.
- Right to rectification: you may request the correction of inaccurate data without undue delay.
- Right to erasure: you may request the deletion of your data under specified conditions.
- Right to be forgotten: if data that has been made public must be deleted, the controller will take reasonable steps to inform other controllers.
- Right to restriction of processing: you may request that processing be restricted in specified cases.
- Right to data portability: you may request that your data be provided in a structured, machine-readable format.
- Right to object: you may object at any time to processing based on legitimate interests.
- Automated decision-making: no automated decision-making, including profiling, takes place during processing.
Deadline for action
The controller will inform you of action taken on your request without undue delay and no later than 1 month after receiving it; this period may be extended by an additional 2 months if necessary.
Data security
Taking into account the state of the art, implementation costs, the nature and scope of processing, and the level of risk, the controller applies appropriate technical and organizational measures to ensure data security, including access restrictions, regular backups, antivirus protection, and password-protected access.
Personal data breaches
If a personal data breach is likely to result in a high risk to the rights of natural persons, the controller will inform the data subject without undue delay and report the breach to the competent supervisory authority within 72 hours where possible.
Right to lodge a complaint
Complaints concerning a potential violation by the controller may be lodged with the Nemzeti Adatvédelmi és Információszabadság Hatóság:
Nemzeti Adatvédelmi és Információszabadság Hatóság
1055 Budapest, Falk Miksa utca 9–11.
Mailing address: 1363 Budapest, Pf. 9.
Phone: +36-1-391-1400
Email: ugyfelszolgalat@naih.hu
Regardless of the above, you also have the right to take legal action directly before a court if your rights are infringed (Article 79 of the GDPR). At the data subject's discretion, proceedings may also be brought before the court with jurisdiction over their permanent or temporary place of residence.
Final provisions
The following legislation and guidance were considered when preparing this policy: Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR); Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information; Act CVIII of 2001 on Electronic Commerce Services; Act XLVII of 2008 on the Prohibition of Unfair Business-to-Consumer Commercial Practices; Act C of 2003 on Electronic Communications; the recommendation of the Nemzeti Adatvédelmi és Információszabadság Hatóság on the data protection requirements for prior notice.