This notice has been prepared under Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Hungarian Act CXII of 2011 on informational self determination and freedom of information, and Hungarian Act CVIII of 2001 on electronic commerce services.
1. The controller
| Name | Kalmár Dániel, sole trader |
|---|---|
| Contact | [email protected] |
For any data protection question or request, please write to the address above. The response time is within 5 working days.
2. What personal data is processed and why
2.1 Contact and enquiry form
| Data processed | Name, email address, phone number, company name, position, content of the message |
|---|---|
| Purpose | Contacting the enquirer, providing a proposal, responding to the enquiry |
| Legal basis | Consent, GDPR Article 6(1)(a) |
| Retention | 3 years from the close of the contact, or until consent is withdrawn |
2.2 Newsletter subscription
| Data processed | Email address, optionally a name |
|---|---|
| Purpose | Regular updates and AI related content |
| Legal basis | Consent, GDPR Article 6(1)(a) |
| Retention | Until unsubscribed, which is possible at any time via the link in the email |
2.3 AI readiness test
| Data processed | Name, email address, company name, test result comprising score and level |
|---|---|
| Purpose | Sending the result by email and possible advisory follow up |
| Legal basis | Consent, GDPR Article 6(1)(a) |
| Retention | 2 years, or until consent is withdrawn |
2.4 KD AI Academy assessments and certificates
| Data processed | Name, email address (optional), assessment answers, score achieved, unique certificate serial number |
|---|---|
| Purpose | Issuing a uniquely numbered certificate on a successful assessment, retrievable by serial number on the verification page |
| Legal basis | Consent, GDPR Article 6(1)(a), given by submitting the assessment |
| Retention | Indefinitely, to keep the certificate verifiable, or until consent is withdrawn |
Viewing the course materials and lessons requires no registration. Only the submission of a final assessment asks for a name and optionally an email address.
2.5 Contracted client data
| Data processed | Name, email, phone number, company name, address, tax number, position, correspondence relating to the engagement |
|---|---|
| Purpose | Providing the service, performing the contract, communication |
| Legal basis | Performance of a contract, GDPR Article 6(1)(b) |
| Retention | 5 years from termination of the contract, the general limitation period under Hungarian civil law |
2.6 Invoicing data
| Data processed | Company name, billing address, tax number, payment transaction data |
|---|---|
| Purpose | Issuing invoices and meeting accounting and tax obligations |
| Legal basis | Legal obligation, GDPR Article 6(1)(c) |
| Retention | 8 years, the mandatory accounting retention period |
2.7 Website analytics
| Data processed | IP address (anonymised), browser type, pages visited, time on site, referring URL |
|---|---|
| Purpose | Analysing website performance and understanding visitor behaviour |
| Legal basis | Legitimate interest, GDPR Article 6(1)(f) |
| Retention | 13 months, the Cloudflare Analytics retention cycle |
3. Processors and third parties
The following providers act as processors. They may process the data only for the purposes and on the conditions determined by the controller.
| Supabase Inc. | Database for contact data, test results and CRM. European Union, eu-west-1, Ireland. GDPR compliant, EU servers. |
|---|---|
| Google LLC | Email delivery via the Gmail API. USA. Standard Contractual Clauses. |
| Google LLC (Analytics) | Visitor analytics, Google Analytics 4. USA and EU, configurable. Standard Contractual Clauses, with EU data processing enabled. |
| LinkedIn Corporation | LinkedIn Insight Tag, conversion tracking and remarketing, only with consent. USA. Standard Contractual Clauses. |
| Cloudflare Inc. | Web hosting via Cloudflare Pages, CDN and basic analytics. EU visitor data processed on EU edge servers. GDPR compliant, cookieless analytics. |
| KBOSS Kft. (Számlázz.hu) | Electronic invoicing. Hungary. GDPR compliant. |
Transfers to the USA take place on the basis of the Standard Contractual Clauses approved by the European Commission, under GDPR Article 46(2)(c).
Personal data is never sold or transferred to third parties for commercial purposes. Data is disclosed to authorities only where required by law.
4. Cookies
The website uses two categories of cookie. On arrival a cookie banner asks for consent to the non essential ones.
Necessary cookies, always active
| Session cookie | Required for the website to function, retaining entered data and navigation. Until the browser is closed. |
|---|---|
| Cookie consent (localStorage) | Stores the visitor's cookie choice so it is not asked again. 1 year. |
| Cloudflare edge analytics | Page load time and availability, without cookies, with IP anonymisation, on EU servers. 13 months. |
Marketing cookies, only with consent
| Google Analytics 4 | Visitor statistics, content effectiveness and conversion tracking. Google LLC. 13 months. |
|---|---|
| LinkedIn Insight Tag | Conversion tracking for LinkedIn campaigns and remarketing. LinkedIn Corporation. 90 days to 1 year. |
Marketing cookies load only if the visitor accepts the cookie banner. The decision can be withdrawn at any time by clearing the browser localStorage or reactivating the banner.
5. Your rights
Under Articles 15 to 22 of the GDPR you may exercise the following rights.
Right of access (Article 15). You may request information about what data is processed, for what purpose and for how long.
Right to rectification (Article 16). You may request correction of inaccurate data.
Right to erasure (Article 17). You may request deletion of your data, except where processing is required by a legal obligation such as accounting retention.
Right to restriction (Article 18). You may request that processing be restricted.
Right to data portability (Article 20). You may request your data in a structured, machine readable format.
Right to object (Article 21). You may object to processing based on legitimate interest.
Withdrawal of consent. Where processing is based on consent, it may be withdrawn at any time without affecting the lawfulness of processing carried out beforehand.
To exercise any of these rights, write to [email protected]. Requests are answered within 5 working days and fulfilled within 30 days at the latest.
6. Remedies
If you believe your rights have been infringed, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 22/c Szílagyi Erzsébet fasor, 1125 Budapest, Hungary, [email protected], or bring proceedings before the competent court.
7. Amendment of this notice
The controller reserves the right to amend this notice. The version in force is always available on this page, with the date of the last update shown at the top.