Legal notice

Privacy policy

Available at: https://siteflow.hu/adatkezelesi-tajekoztato/. Amendments to this policy take effect upon publication at the address above. Last updated: 24 October 2026.

Introduction

FIEDLER ATTILA (1191 Budapest, Kisfaludy utca 16. 10. em. 30., tax number: 59604273-1-43, company registration number/registration number: 57651444) (hereinafter: Service Provider, controller) agrees to be bound by the following policy: we provide the following information in accordance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (27 April 2016, General Data Protection Regulation, "GDPR") on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation 95/46/EC.

This privacy policy governs data processing on the following website: https://siteflow.hu/

The controller and contact details

Name: Fiedler Attila
Registered office: 1191 Budapest, Kisfaludy utca 16. 10. em. 30.
Email: info@siteflow.hu
Phone: +36 20 381 2463

Definitions

1. "personal data": any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person;
2. "processing": any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction;
3. "controller": the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of processing personal data;
4. "processor": a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller;
5. "recipient": a natural or legal person, public authority, agency, or other body to which personal data is disclosed, whether or not a third party;
6. "consent of the data subject": any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which the data subject, through a statement or clear affirmative action, signifies agreement to the processing of personal data relating to them;
7. "personal data breach": a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed;
8. "profiling": any form of automated processing of personal data involving the use of personal data to evaluate, analyze, or predict certain personal characteristics relating to a natural person.

Principles governing the processing of personal data

Personal data is processed in accordance with the following principles: lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality. The controller is responsible for complying with these principles and must be able to demonstrate such compliance ("accountability").

Data processing related to operating the service

1. The fact of data collection, categories of data processed, and purposes of processing

Categories of data subjects: website visitors, people requesting quotes, and clients using the service.

Duration of processing and deadline for deleting data: the Service Provider retains data submitted through the website's forms (contact, quote request) for 365 days from submission and then deletes it automatically, unless the data subject requests deletion earlier or the data results in a contract/invoice. If any of the conditions set out in Article 17(1) of the GDPR applies, processing continues until the data subject requests deletion. Accounting records are an exception, as this data must be retained for 8 years under Section 169 (2) of Act C of 2000 on Accounting. The data subject's contractual data may be deleted at the data subject's request after the civil-law limitation period expires.

Persons authorized to access the data: personal data may be processed by the controller and its authorized staff.

Rights of data subjects: the data subject may request access to, correction, deletion, or restriction of processing of personal data relating to them from the controller and has the right to data portability and to withdraw consent at any time. This may be done by mail (1191 Budapest, Kisfaludy utca 16. 10. em. 30.), email (info@siteflow.hu), or phone (+36 20 381 2463).

Legal basis for processing: Article 6(1)(b) of the GDPR; Section 13/A (3) of the Elker tv.; for invoicing under accounting laws, Article 6(1)(c) of the GDPR; for enforcing claims arising from a contract, the 5-year limitation period under Section 6:22 of the Civil Code (Act V of 2013).

Processing is necessary to perform the contract and provide a quote. Providing personal data is mandatory for performing the contract; without it, handling the inquiry and providing the service is not possible.

Cookie management

Prior consent is not required for the use of "necessary" and "security" cookies because they are essential to the website's basic operation. In contrast, using "functional" and "statistical" cookies requires your express prior consent, which is managed through the cookie settings panel displayed on the website.

Categories of data processed: unique identification number, dates, times. Categories of data subjects: all data subjects who visit the website.

Rights of data subjects: consent to non-essential cookies may be changed or withdrawn at any time through the cookie settings panel displayed on the website. Cookies can also be deleted manually from the browser's Tools/Settings menu.

Browser-specific settings: Google Chrome · Microsoft Edge · Mozilla Firefox · Apple Safari

Use of Google Ads conversion tracking

This section concerns data processing planned by the Service Provider for the future—the processing described here will not take place until tracking is actually implemented.

The controller plans to use the "Google Ads" online advertising program, including Google's conversion tracking service (Google Ireland Limited, Ireland, and its parent company Google LLC, USA). When a User reaches the website through a Google ad, a cookie required for conversion tracking is placed on their computer. Each Google Ads client receives a different cookie, so Users cannot be tracked across client websites. The information is used to compile conversion statistics—the controller does not receive data that can directly identify the User, such as a name or email address.

Under Google Consent Mode v2, the ad_user_data and ad_personalization cookie types are based on the data subject's consent; the controller ensures that the appropriate consent can be given and withdrawn through its cookie banner. Consent may be withdrawn at any time through the cookie settings panel; this does not affect the lawfulness of processing carried out before consent was withdrawn. More information: https://policies.google.com/privacy

Use of Google Analytics

This section concerns data processing planned by the Service Provider for the future—the processing described here will not take place until tracking is actually implemented.

The website plans to use the Google Analytics web analytics service in the future (Google Ireland Limited, Ireland, and its parent company Google LLC, USA), which uses cookies to analyze website usage. The legal basis for using the service is your freely given prior consent, which you may give or withdraw at any time through the cookie settings panel. You can also prevent cookies from being stored through your browser settings; in that case, some website features may not be fully available.

If Google Ads and Google Analytics services are activated, data may also be transferred to Google LLC, based in the USA. The legal basis for such transfers is the European Commission's adequacy decision (EU–US Data Privacy Framework, "Data Privacy Framework"), details of which are available at: https://www.dataprivacyframework.gov/. The controller notes that the validity of this legal basis may be affected by international court proceedings; current status information is available on the website above and through notices issued by the NAIH.

Uploaded photos and AI images on the preview page (editor mode)

If the preview (demo) page can be edited, the data subject can replace its images with their own photos, with an image generated by artificial intelligence from their own description, or with a sample image.

Categories of data subjects: people who use the preview page editor, and any other identifiable natural person shown in an uploaded photo.

Retention: if no order is placed, own photos and AI images are deleted automatically when the preview expires, and no later than 30 days after expiry. The data subject can delete an own photo immediately at any time with the "Delete" button on the Images tab; the file is then also removed from earlier versions. The "Back to the original" button does not delete the photo, it only resets the image spot, so the photo can still be restored from History. If an order is placed, the images recorded on the preview become part of the project materials (own photos are also added to the "Own photos" field of the detailed brief); their copy available on the preview page is deleted 90 days after the contract ends (cancellation, withdrawal or the end of the term), and the copy stored in the project is kept for building and operating the Website for the term of the contract, and then for 90 days after the contract ends. Under its current terms, OpenAI does not retain the copy sent for content filtering. The declaration log is deleted together with the questionnaire data (90 days after completion) if no order is placed, or 5 years after the contract ends if an order is placed.

Rights of the person shown and how to request deletion: The controller does not inform any other person shown in a photo directly, because their contact details are not available to it (Article 14(5)(b) of the GDPR); instead, the controller makes this information publicly available in this notice. Anyone who sees their own image on a preview page without having consented to it can request its removal and deletion at info@siteflow.hu; it is enough to give the link of the preview page or a short description of the image, and the requester's contact details. After checking the request, the controller removes the image without undue delay and informs both the requester and the uploader. Any other image considered unlawful can be reported at the same address (General Terms, clause 11.9).

Complaint handling

Categories of data subjects: all data subjects who use the service and raise a quality concern or submit a complaint. Duration of processing: copies of the complaint record, transcript, and response must be retained until the end of the general limitation period under the Civil Code (5 years).

Recipients to whom personal data is disclosed

Processors

To support its own processing activities and fulfill its obligations under contracts with data subjects and applicable laws, the controller uses the following processors:

Social media

The fact of data collection, categories of data processed: the name registered on Facebook and LinkedIn and the user's public profile picture. Categories of data subjects: all data subjects registered on Facebook or LinkedIn who have "liked"/followed the Service Provider's social media page or contacted the controller through it. Purpose of data collection: sharing and promoting the website's content and services. Legal basis for processing: the data subject's freely given consent.

Joint processing by Facebook / Meta

The controller maintains a Facebook/Meta profile for its business activities. Processing for statistical purposes on Facebook is carried out jointly by the controller and Facebook Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland); details are provided in the Page Insights Controller Addendum: https://www.facebook.com/legal/terms/page_controller_addendum. The controller communicates by private message on social media only if you contact it there. Processing continues until consent is withdrawn or, for message exchanges, for no more than 2 years.

Client relationships and other processing

If you have a question or encounter a problem while using the service, you may contact the controller through the methods listed on the website (phone, email, social media). The controller deletes received emails, messages, and personal data voluntarily provided in them no later than 2 years after the data is provided, unless the matter results in a contract or another legal basis requires a longer retention period, such as complaint handling or invoicing.

AI-assisted reply drafts for emails sent to info@siteflow.hu: incoming emails are reviewed by a program running on the controller's own computer. Newsletters, automatic replies and system notifications are filtered out based on their headers, and their content is not transferred. For all other emails, the sender's name and email address, the subject and text of the email, the earlier quoted part of the conversation and — if the sender is a client or prospective client of the controller — the related records held about them (name, company name, the status of their order or proposal) are transferred to OpenAI Ireland Limited (Dublin, Ireland), which processes them in the systems of OpenAI, L.L.C. (United States of America); the transfer is safeguarded by the standard contractual clauses under Commission Implementing Decision (EU) 2021/914, and under its terms of service the provider does not use data submitted through its API to train its models. Purpose: classifying the email and preparing a reply draft, which the program saves among the drafts of the controller's mailbox. The program sends nothing: every reply is checked, edited where necessary and sent by the controller personally; the program only classifies emails and takes no decision based solely on automated processing that produces legal or similarly significant effects for the data subject (Article 22 GDPR). The data subjects concerned include third parties named in the email. Please do not send special categories of personal data (such as health data) by email. Legal basis: where the email is a pre-contractual enquiry or relates to an existing contract, Article 6(1)(b) GDPR; otherwise Article 6(1)(f) GDPR (the controller's legitimate interest in answering enquiries quickly and accurately, based on a balancing test). You may object to processing based on legitimate interest at any time under Article 21 GDPR by writing to info@siteflow.hu, after which the program skips your emails. The internal log of the processing (sender, subject, a one-sentence summary) is deleted after 45 days; the email itself and the reply fall under the retention period of up to 2 years described above.

Companion (chat window) on the ordering pages: on the pages of the website related to ordering, an automated assistant based on artificial intelligence answers visitors' questions; this is indicated in the header of the chat window. The questions typed in and the last 12 turns of the conversation at most are transferred to OpenAI Ireland Limited to prepare the answer, under the conditions and safeguards described above for AI-assisted reply drafts. The conversation is not stored on the server: it exists only in the visitor's browser until the page is closed. To prevent excessive or abusive use, a pseudonymised identifier derived from the IP address is stored for up to 1 hour, and a daily aggregate count containing no personal data is kept. If the visitor asks for the question to be forwarded to Attila Fiedler, they provide their email address; the email address and the conversation are then sent by email to info@siteflow.hu and fall under the retention period of up to 2 years described above. Legal basis: for answering questions, Article 6(1)(f) GDPR (the controller's legitimate interest in answering visitors' questions immediately, based on a balancing test that can be requested at info@siteflow.hu and against which the data subject may object at any time under Article 21 GDPR); for pre-contractual questions and for forwarding, Article 6(1)(b) GDPR (steps taken at the data subject's request); for storing the pseudonymised IP identifier, Article 6(1)(f) GDPR (the controller's legitimate interest in preventing abusive use of the service). The companion takes no decision based solely on automated processing that produces legal or similarly significant effects for the data subject (Article 22 GDPR). Please do not enter more personal data in the chat than your question requires, and no special categories of personal data (such as health data) at all.

Booking a 20-minute call (siteflow.hu/idopont) and preparing the call

On the website's booking page, visitors can book a 20-minute conversation with the controller. Data processed: name, company name (optional), phone number, email address, the note on what they would like to discuss, and the chosen time slot. Purpose: arranging and holding the call, confirming the booking by email and recording it in the controller's client records; legal basis: Article 6(1)(b) GDPR (steps taken at the data subject's request prior to entering into a contract). To prevent the same slot from being booked twice, the email address and the booking time are stored on the server in a lock file for the booked slot, which is deleted automatically on the 14th day after the call.

Preparing the call with artificial intelligence: before the call, the booking data and — if the person is a prospective or existing client — the records held about them (answers to the questionnaire and the brief, the status of the order or proposal) are transferred to OpenAI Ireland Limited, under the conditions and safeguards described above for AI-assisted reply drafts, to prepare a briefing summary that is placed in the controller's own mailbox (legal basis: Article 6(1)(f) GDPR, the controller's legitimate interest in holding a well-prepared call; the balancing test can be requested at info@siteflow.hu, and you may object under Article 21 GDPR). After the call, the controller's own notes are processed in the same way to produce organised notes and, where needed, a follow-up email draft relating to the proposal requested or the next step agreed in the call, which the program does not send: the controller checks it and sends it personally (legal basis: Article 6(1)(b) GDPR). The copy of the notes on the controller's computer is deleted after 45 days; the emails about the booking, the briefing and the call fall under the retention period of up to 2 years described in "Client relationships and other processing". No decision based solely on automated processing that produces legal or similarly significant effects is taken (Article 22 GDPR). Without the name, phone number and email address the booking cannot be submitted; the company name and the note are optional.

Partner program—data collection through intermediary referrals

The controller operates a partner program under which contracted intermediary partners may provide the controller with the contact details (name, company name, phone number, email address) of potential clients interested in website development services. Categories of data subjects: all potential clients whose data is provided to the controller by an intermediary partner. Purpose of processing: making contact and providing a quote. Legal basis for processing: the data subject's consent (Article 6(1)(a) of the GDPR), or the legitimate interests of the controller and the partner in offering the service (Article 6(1)(f) of the GDPR).

Joint processing: during the stages of identifying potential clients, making initial contact, and transferring data, the controller and the intermediary partner are joint controllers under Article 26 of the GDPR because the controller determines the target client group and the content of the outreach, while the partner makes the actual contact independently using its own resources. For all subsequent processing after the data is received (providing a quote, entering into a contract, performance, invoicing), the controller acts as an independent controller. The information required under Article 13 of the GDPR is provided primarily by the intermediary partner when the data is collected. Under Article 26(3) of the GDPR, you may exercise your rights against either controller—the controller's contact details are provided at the beginning of this policy.

Duration of processing: if the quote does not result in a contract, the controller deletes the data received from the intermediary partner after no more than 365 days.

Rights of data subjects

• Right of access: you may obtain confirmation of whether your data is being processed and access the data.
• Right to rectification: you may request the correction of inaccurate data without undue delay.
• Right to erasure: you may request the deletion of your data under specified conditions.
• Right to be forgotten: if data that has been made public must be deleted, the controller will take reasonable steps to inform other controllers.
• Right to restriction of processing: you may request that processing be restricted in specified cases.
• Right to data portability: you may request that your data be provided in a structured, machine-readable format.
• Right to object: you may object at any time to processing based on legitimate interests.
• Automated decision-making: no automated decision-making, including profiling, takes place during processing.

Deadline for action

The controller will inform you of action taken on your request without undue delay and no later than 1 month after receiving it; this period may be extended by an additional 2 months if necessary.

Data security

Taking into account the state of the art, implementation costs, the nature and scope of processing, and the level of risk, the controller applies appropriate technical and organizational measures to ensure data security, including access restrictions, regular backups, antivirus protection, and password-protected access.

Personal data breaches

If a personal data breach is likely to result in a high risk to the rights of natural persons, the controller will inform the data subject without undue delay and report the breach to the competent supervisory authority within 72 hours where possible.

Right to lodge a complaint

Complaints concerning a potential violation by the controller may be lodged with the Nemzeti Adatvédelmi és Információszabadság Hatóság:

Nemzeti Adatvédelmi és Információszabadság Hatóság
1055 Budapest, Falk Miksa utca 9–11.
Mailing address: 1363 Budapest, Pf. 9.
Phone: +36-1-391-1400
Email: ugyfelszolgalat@naih.hu

Regardless of the above, you also have the right to take legal action directly before a court if your rights are infringed (Article 79 of the GDPR). At the data subject's discretion, proceedings may also be brought before the court with jurisdiction over their permanent or temporary place of residence.

---

Final provisions

The following legislation and guidance were considered when preparing this policy: Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR); Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information; Act CVIII of 2001 on Electronic Commerce Services; Act XLVII of 2008 on the Prohibition of Unfair Business-to-Consumer Commercial Practices; Act C of 2003 on Electronic Communications; the recommendation of the Nemzeti Adatvédelmi és Információszabadság Hatóság on the data protection requirements for prior notice.