PSH
    hu

    Privacy Policy

    1. Identity of the data controller

    • Name of the controller: Perfect System Hungary Kft.
    • Registered office: 3534 Miskolc, Almás utca 11., Hungary
    • Company registration number: 05-09-039501
    • Registry court: Miskolci Törvényszék Cégbírósága
    • Tax number: 32955985-2-05
    • Representative: Kiss Dorka
    • Email: perfectsystemhungary@gmail.com
    • Phone: +36 20 212 5022

    Hosting provider

    2. Scope of this privacy policy

    This privacy policy applies to the processing of personal data carried out on the website of Perfect System Hungary Kft., in particular to:

    • the use of the quote request form,
    • the use of the callback request form,
    • file uploads,
    • the use of cookies and measurement tools,
    • the use of Google reCAPTCHA v2,
    • the display of customer reviews on the website,
    • and to the processing related to any contact made through the website.

    3. Principles of processing

    The controller processes personal data

    • lawfully, fairly and in a transparent manner,
    • for specified, explicit and legitimate purposes,
    • in accordance with the principle of data minimisation,
    • accurately and, where necessary, kept up to date,
    • subject to storage limitation,
    • protected by appropriate technical and organisational measures.

    The controller requests and processes only such data as are necessary for handling the given enquiry, for making contact, for preparing a quotation, or for the secure operation of the website. This is in line with the principles of the GDPR and with the requirement of clear, prior information.

    4. Data processed in connection with a quote request

    4.1. Categories of data processed

    When the quote request form is completed, the following data are processed:

    • name,
    • phone number,
    • email address,
    • town or city,
    • the selected service,
    • an indication that the enquiry is urgent, if the data subject marks it as such,
    • the content of the message,
    • the content of the uploaded file(s),
    • in the case of a business enquiry: company name and tax number,
    • the source data of the enquiry: the page from which the form was submitted, the path of the landing page of the visit (the first page of the visit, without the parameters of the link) and, where the data subject arrived from an advertisement or campaign link, the campaign identifiers contained in that link (utm_source, utm_medium, utm_campaign, utm_content, utm_term). The campaign identifiers may also come from the link of the first page of the visit, if the data subject moved on from there before submitting the form. If the data subject arrived from a Google Ads advertisement, the following are also recorded from the parameters received in the link of the first page of the visit: the Google Ads campaign identifier (gad_campaignid) and – where the link of the advertisement contains them – the keyword of the advertisement (psh_kw; the keyword set by the controller for the advertisement, not the search term entered by the visitor), the match type of the keyword (psh_mt), the device type (psh_dev; mobile, tablet or computer), the advertising network (psh_net) and the identifier of the advertisement (psh_cr). If the link contained a Google Ads click identifier but no campaign source (utm_source), the source of the enquiry is recorded as “google / cpc” (a campaign medium given in the link is kept); the click identifier itself is not stored (neither the value of the gclid nor that of the gbraid or wbraid parameter).

    In addition, the controller records the outcome of the enquiry as part of its internal case handling – what became of the enquiry (quotation sent, ordered, or lost) and when – and, in the case of an order, the value of the order. These data are not provided by the data subject but are recorded by the controller.

    4.2. Purposes of the processing

    The purposes of the processing are:

    • making contact,
    • preparing a quotation,
    • understanding the submitted request,
    • discussing in advance the conditions for providing the service,
    • obtaining further clarification where necessary,
    • after the enquiry has been closed: preserving the customer history and handling later enquiries, orders and complaints (see Sections 4.3 and 4.4),
    • in the case of the source data: establishing which page or campaign (including from an advertisement shown for which keyword and on what device) the enquiry originated from, that is, measuring the effectiveness of the controller's marketing activity,
    • in the case of the outcome of the enquiry and the value of the order: handling orders and measuring which pages or campaigns the enquiries that resulted in orders originated from, and with what value (effectiveness measurement).

    4.3. Legal basis of the processing

    For the substantive data of the quote request (name, contact details, town or city, selected service, urgency, message, company name and tax number, uploaded files), the legal basis is Article 6(1)(b) GDPR, namely taking steps at the request of the data subject prior to entering into a contract and, where a contract results, the performance of that contract.

    Processing the source data of the enquiry (page visited and landing page, campaign identifiers, the data of the Google Ads advertisement set out in Section 4.1) is not necessary for the preparation of a contract; the legal basis for these data is therefore Article 6(1)(f) GDPR, the legitimate interest of the controller in measuring the effectiveness of its marketing activity and in spending its advertising budget reasonably. The data subject may object to this processing at any time in accordance with Section 19; such an objection does not affect the handling of the enquiry itself.

    The legal basis for recording the outcome of the enquiry and the value of the order is Article 6(1)(f) GDPR, the legitimate interest of the controller in internally tracking enquiries and orders and in measuring the effectiveness of its marketing activity; where the enquiry results in an order, processing the data of the order is also necessary for the performance of the contract (Article 6(1)(b) GDPR). The data subject may object at any time, in accordance with Section 19, to the processing carried out for the purpose of effectiveness measurement.

    The legal basis for retention after the enquiry has been closed, as set out in Section 4.4 – beyond the processing necessary for the performance of a contract and for compliance with legal obligations – is Article 6(1)(f) GDPR, the legitimate interest of the controller in preserving the customer history and in handling later enquiries, orders and complaints, in particular in being able to demonstrate what enquiry was received and what quotation the controller gave in response, in recognising returning enquirers, and in handling any complaint or legal claim connected with the enquiry. This also applies to the uploaded files. The data subject may object to this processing at any time in accordance with Section 19.

    The legal basis for retention required by law (in particular by the accounting rules) is Article 6(1)(c) GDPR.

    4.4. Retention period

    The controller processes the data provided in the quote request and the files uploaded with the enquiry – whether or not a contract results from the quote request – for the purpose of preserving the customer history and handling later enquiries, orders and complaints, indefinitely, until the data subject's request for erasure or successful objection. No automatic deletion takes place.

    The controller retains the source data of the enquiry (Section 4.1) and the data relating to its outcome together with the enquiry, under the same rule; if the data subject successfully objects to the processing of the source data, the controller no longer processes the source data, without affecting the other data of the enquiry.

    Where the quote request results in an order, a contract or performance, the controller retains the data at least for the duration of the related legal relationship, for the period necessary to document performance – including for the establishment, exercise or defence of legal claims – and for the period prescribed by the applicable statutory – in particular accounting – obligations.

    In accordance with Section 19, the data subject may at any time request the erasure of their data and uploaded files at the email address or postal address given in Section 1. The controller fulfils the request for erasure within one month of its receipt at the latest, except for data whose retention is required by law (in particular by the accounting rules) or which are necessary for the performance of an existing legal relationship or for the establishment, exercise or defence of legal claims; the controller retains such data only for as long as is necessary for that purpose, and informs the data subject accordingly. Erasure also covers the files held in the file storage and the internal notification emails about the enquiry; copies held in backups are erased through the cyclical deletion of backups within 30 days at the latest.

    The retention rule set out in this Section 4.4 (indefinitely, until the data subject's request for erasure or successful objection) also applies to enquiries received before 3 October 2026, including those for which an earlier version of this privacy policy provided for automatic deletion after 12 or 6 months; in respect of those enquiries, too, the data subject may request the erasure of their data at any time.

    5. Callback requests

    5.1. Data processed

    When a callback is requested, the following data are processed:

    • name,
    • phone number,
    • an indication of whether the enquiry is residential or business,
    • the selected service, if provided by the data subject,
    • the requested callback time or availability, if provided by the data subject,
    • a short message or request, if provided by the data subject,
    • the source data of the enquiry as set out in Section 4.1 (page visited and landing page, campaign identifiers, the data of the Google Ads advertisement),
    • the outcome of the enquiry as set out in Section 4.1 (internal case-handling data of the controller).

    5.2. Purpose

    The purpose of the processing is to enable the controller to contact the data subject and to fulfil the callback request. The purpose of the source data and of the outcome of the enquiry is the effectiveness measurement described in Section 4.2 and the handling of orders. After the enquiry has been closed, the purpose of the processing is, as set out in Section 4.2, preserving the customer history and handling later enquiries, orders and complaints.

    5.3. Legal basis

    Article 6(1)(b) GDPR for the data of the callback request; for the source data and the outcome of the enquiry, as explained in Section 4.3, Article 6(1)(f) GDPR, the legitimate interest of the controller.

    The legal basis for retention after the enquiry has been closed, as set out in Section 5.4, is – as explained in Section 4.3 – Article 6(1)(f) GDPR, the legitimate interest of the controller in preserving the customer history and in handling later enquiries, orders and complaints, in particular in being able to demonstrate what callback the data subject requested and how the controller responded, in recognising returning enquirers, and in handling any complaint or legal claim connected with the enquiry. The data subject may object to this processing at any time in accordance with Section 19.

    5.4. Retention period

    The controller processes callback request data – whether or not a further legal relationship arises from the enquiry – for the purpose set out in Section 4.4, indefinitely, until the data subject's request for erasure or successful objection. No automatic deletion takes place. Where the enquiry results in an order or a contract, retention lasts at least for the period set out in the second paragraph of Section 4.4. The submission and fulfilment of a request for erasure are governed by Section 4.4.

    6. File uploads

    6.1. Purpose of file uploads

    The purpose of the file upload is to make the quotation more accurate, to better understand the technical content and to assess the task in advance. After the enquiry has been closed, the purpose of processing the uploaded files is, as set out in Section 4.2, preserving the customer history and handling later enquiries, orders and complaints.

    6.2. Which files may be uploaded

    The data subject may upload photographs, documents or other files relevant to the quotation. Such a file may also contain personal data.

    6.3. Legal basis

    Article 6(1)(b) GDPR; for retention after the enquiry has been closed, as set out in Section 6.4 – as explained in Section 4.3 – Article 6(1)(f) GDPR, the legitimate interest of the controller in being able to demonstrate on the basis of which technical information provided by the data subject (photographs, documents) the quotation was prepared, and in handling any complaint or legal claim connected with the enquiry. The data subject may object to this processing at any time in accordance with Section 19.

    6.4. Retention period

    The controller processes and retains uploaded files together with the quote request – whether or not a contract or other legal relationship arises from it – indefinitely, until the data subject's request for erasure or successful objection. No automatic deletion takes place. In the event of a request for erasure (Section 4.4), the files are also deleted from the file storage.

    Please upload only those files that are necessary for the quotation.

    7. Technical processing related to the operation of the website

    The system serving the website creates technical logs for the purposes of secure operation and troubleshooting; these may contain, for example, the IP address, the time of the request, the address of the requested page, and browser and device data. The parameters of the address of the requested page may also include an advertising click identifier (for example gclid, gbraid, wbraid); in this technical log kept for security purposes it is retained for the period set out in Section 18. The legal basis for this processing is Article 6(1)(f) GDPR, the legitimate interest of the controller in the availability and security of the website.

    In addition, the controller keeps its own event log on the use and operation of the website that contains no personal data. This records only the type of the event (for example a click on the phone number, or a signal as to whether an element built into the page – such as the captcha of the forms or the reviews element – is working or has reported an error), for certain events a detail selected from a predefined list (for example the kind of error), for a click on the phone number the advertising source marker described in Section 12.1, the path of the page and the time of the event. It stores no IP address, no browser or device identifier, no cookie and no other data capable of identifying the data subject; the data thus generated therefore do not qualify as personal data. Operational signals from browsers that identify themselves as robots (for example search engine crawlers) are disregarded on the basis of the browser's type string (user agent), without storing it.

    The exception is the log of the captcha checks of submitted enquiries (quote and callback requests): it records the result of the check (together with the error codes returned by Google) and the internal identifier of the enquiry, so that submission failures can be traced. The legal basis is Article 6(1)(f) GDPR, the controller's legitimate interest in the secure operation of the website; the system deletes this log automatically after 90 days.

    Aggregated arrival count: to measure how many visits arrive at the individual pages of the website from a Google advertisement, from another campaign link or from neither, the web server serving the website writes, when pages are requested, only the time of the request, the path of the requested page (without the parameters of the link), the type of source (Google advertisement, other campaign or none – determined on the basis of whether the corresponding parameters are present in the link) and the campaign identifier contained in the link into a separate, short-lived log. No IP address, no browser or device data (user agent), no referring page (referer) and no value of a click identifier (gclid, gbraid, wbraid) is written into this log. The system aggregates this log every hour into daily counts per page and per campaign, and removes the raw lines after aggregation; if an aggregation fails, the raw lines are kept until the next successful retry, which normally means at most about one hour. The aggregated count contains no personal data. For this counting the website uses neither cookies nor any identifier stored on the visitor's device, and the counting works independently of cookie consent. The legal basis for processing the raw log is Article 6(1)(f) GDPR, the legitimate interest of the controller in spending its advertising budget reasonably and in measuring the effectiveness of its marketing activity. The data subject may object to this processing at any time in accordance with Section 19.

    Non-essential cookies and measurement technologies are not activated automatically: until consent is given, the website places no statistics or marketing cookie and stores no identifier on your device. The only exception is the technical framework of the Google Tag Manager container, which is loaded before your decision as well so that the Google Consent Mode v2 signals can take effect; the container itself neither places cookies nor stores identifiers (see Section 9).

    8. Cookies and similar technologies

    8.1. What cookies are

    Cookies are small data files that a website may place in the visitor's browser. Some of them are necessary for the operation of the website, while others serve to measure and analyse its use or serve marketing purposes. The use of the browser's local storage (localStorage) also qualifies as a technology similar to cookies.

    8.2. Strictly necessary cookies

    Strictly necessary cookies serve the basic operation of the website. One such cookie is the controller's own psh_consent cookie, which stores the visitor's cookie choice, its timestamp and the version number of the consent manager, so that the system can respect that choice on every page load. Its lifetime is 1 year; the same value is also stored in the browser's local storage.

    This category also covers the abuse-prevention cookies of Google reCAPTCHA, which are created only on pages that contain the quote request form (see Section 13 for details).

    Legal basis: Article 6(1)(f) GDPR, the legitimate interest of the controller, and the technical provision of electronic communication.

    8.3. Statistical cookies

    The website uses Google Analytics 4 to measure traffic and usage patterns. The related cookies (_ga and _ga_<measurement-id>, which contains the measurement identifier) have a lifetime of 2 years. They are placed only after consent to statistical measurement has been given.

    Legal basis: the consent of the data subject, Article 6(1)(a) GDPR.

    8.4. Marketing cookies

    The website uses Google Ads conversion measurement to measure campaign performance. The related _gcl_au cookie has a lifetime of approximately 90 days. If the visitor arrived by clicking a Google Ads advertisement, the ad-click identifier is stored in the _gcl_aw cookie for approximately 90 days, so that a later quote request or call-back request can be attributed to that advertisement. For clicks from iOS devices or app campaigns, and to record the source of the advertisement, Google may also create the _gcl_gb, _gcl_ag or _gcl_gs cookie for the same purpose. Google may also create a _gcl_ls entry in the browser's local storage. These are created only after consent to marketing measurement has been given.

    No Meta Pixel is currently integrated into the website, and no such processing takes place. Should it be introduced in the future, it could only be activated on the basis of marketing consent, and this policy would be updated accordingly.

    Legal basis: the consent of the data subject, Article 6(1)(a) GDPR.

    8.5. Managing consent

    Non-essential cookies are activated solely on the basis of the data subject's prior consent. The website applies Google Consent Mode v2: measurement and advertising signals are denied by default and are granted only in accordance with the visitor's choice. On the consent bar and in the “Cookie settings” window the visitor also decides whether Google reviews are shown automatically (“Google content” category, described in Section 14); this category does not affect the Consent Mode signals.

    Consent may be withdrawn at any time via the “Cookie settings” item in the footer of the website. Withdrawing consent is as easy as giving it: once consent is withdrawn the measurement scripts concerned are removed, and the website also deletes the statistics and marketing cookies created earlier from the device (_ga, _ga_<measurement-id>, _gcl_au, _gcl_aw, _gcl_gb, _gcl_ag, _gcl_gs, and the _gcl_ls local storage entry).

    The state of the consent – together with the timestamp of the choice and the version number of this policy – is stored exclusively on the visitor's own device, in the psh_consent cookie and in the browser's local storage. The controller does not keep a server-side consent record; consequently, deleting the data stored on the visitor's device (for example by clearing browsing data) also removes the consent.

    9. Google Tag Manager

    The website uses Google Tag Manager (container ID: GTM-T77MFXM7) to manage measurement and marketing tags. Tag Manager is not an analytics tool in its own right, but the technical framework for loading tags; the processing carried out by the tags managed through it is described in Sections 10 and 11.

    The Tag Manager container is loaded even before the visitor's decision, because the Google Consent Mode v2 signals must apply from the moment of loading: at load time every measurement and advertising signal is set to denied. Regardless of the decision, the container is loaded on every page view, including after a refusal or after consent has been withdrawn. The container itself neither places cookies nor stores identifiers on your device. When the container is downloaded, your IP address and browser data are transmitted to Google. The statistics and marketing tags managed through the container are activated only after consent has been given.

    Legal basis: for loading the container and the related transmission of the IP address, Article 6(1)(f) GDPR, the controller's legitimate interest in operating the measurement framework and the consent signals; for the statistics and marketing tags managed through the container, Article 6(1)(a) GDPR, the consent of the data subject. The data subject may object to the loading of the container, as processing based on legitimate interest, at any time in accordance with Section 19.

    10. Google Analytics 4

    10.1. Purpose

    Analysing the use of the website, obtaining traffic data, and analysing user journeys and behavioural patterns in aggregate form. Measurement ID: G-MPVTNHVWYF.

    10.2. Legal basis

    Article 6(1)(a) GDPR, the consent of the data subject. In the absence of consent the service is not loaded and places no cookie.

    10.3. Categories of data processed

    Technical and usage data, for example:

    • IP address in a shortened or otherwise technically processed form,
    • device and browser data,
    • page view and event data,
    • clicks and usage patterns.

    10.4. Events forwarded

    Only after consent to statistical measurement has been given, Google Tag Manager forwards two custom events to Google Analytics 4, in addition to the usage events collected automatically by GA4 (page views, sessions, scrolling, form interactions, etc.):

    • generate_lead – a quote request or call-back request has been sent; as its own data it carries only the type of the form (residential, business or call-back request),
    • click_call – a click on the displayed phone number; as its own data it carries only the part of the page where the phone number is located (for example header or footer).

    The two custom events do not contain the visitor's name, phone number or email address, nor the reference number or the text of the quote request. In the absence of consent to statistical measurement these events are not forwarded.

    11. Google Ads conversion measurement

    11.1. Purpose

    Measuring which campaign the visitors of the website arrived from and whether they performed a specified action, such as requesting a quote or making contact. Conversion ID: AW-17956096620.

    11.2. Legal basis

    Article 6(1)(a) GDPR, the consent of the data subject. In the absence of consent, conversion measurement is not started.

    11.3. Retrieval of aggregated campaign data

    To evaluate the effectiveness of its advertisements, the controller retrieves aggregated data broken down by campaign and by day from its Google Ads account (for example the number of impressions, clicks and conversions, and the cost) and displays them on its administration interface. These data contain no data relating to individual visitors or clicks and are therefore not personal data; no data about the visitors of the website are transmitted to Google in the course of the retrieval.

    12. Measurement of phone number clicks

    The website measures how often visitors click on the displayed phone number in two mutually independent ways.

    12.1. The controller's own, non-identifying counter

    The controller's own system records only the type of the event, the path of the page, the time of the click, and whether the visitor arrived from an advertisement (Google advertisement, other campaign link or neither) and, in the case of a Google advertisement, from which campaign (the Google Ads campaign identifier, which identifies the campaign, not the visitor). The website determines the advertising source from the link of the first page of the visit and keeps it only in the memory of the page. This measurement uses no cookie, neither reads nor stores any data on the visitor's device, and records no IP address, browser data or identifier; it is therefore not capable of identifying the visitor, and the value of the click identifier (gclid) is not included either. The purpose of the processing is the aggregate measurement of contact activity, including per campaign; the data generated in this way are not personal data.

    12.2. Measurement using Google tools

    If the visitor has consented to marketing measurement, the phone click event is also forwarded through Google Tag Manager to Google Ads, where it is recorded as a separate conversion event. If the visitor has consented to statistical measurement, the click is also forwarded to Google Analytics 4 as a click_call event, carrying only the part of the page where the phone number is located (see Section 10.4). The legal basis for both transfers is Article 6(1)(a) GDPR, the consent of the data subject; in the absence of the relevant consent the transfer does not take place.

    13. Google reCAPTCHA v2

    The website uses the Google reCAPTCHA v2 service to protect its forms against spam and abuse. reCAPTCHA is loaded only on those pages that contain the quote request form.

    13.1. Purpose

    Filtering out automated abuse, unsolicited submissions and bot traffic, and protecting the technical and IT security of the website.

    13.2. Legal basis

    Article 6(1)(f) GDPR, the legitimate interest of the controller.

    13.3. Note

    When reCAPTCHA is used, Google processes technical data (for example the IP address, device and browser data, and data relating to user interaction) for the purpose of filtering out unsolicited, automated submissions, and may place its own cookies for this purpose.

    14. Display of customer reviews

    If enabled by the controller, the website may show a section in which the business's public Google reviews can be viewed: the summary (average rating and number of ratings) is shown by an embedded element provided by Google LLC itself (Google Maps Platform, "Places UI Kit"), and the reviews (up to five, with the author's name, photo and a link to Google Maps) are requested from Google by the visitor's browser (Google Maps Platform, "Places API") and displayed by the website. The controller does not store the reviews: they are loaded directly from Google's servers into the visitor's browser.

    14.1. Purpose

    Building trust and presenting public reviews of the services provided.

    14.2. Loading and the data transferred

    Google's element and the reviews are loaded in two cases. They load automatically – without a click, when the page is opened, or immediately when consent is given – if the visitor has consented to the “Google content” category: with the "Accept all" button of the consent bar, or by switching the category on in the “Cookie settings” window. The "Analytics only" and "Reject" buttons do not give consent to this category, and consent to statistics or marketing purposes does not authorise the loading either. Without such consent, they only appear if the visitor clicks the "Show reviews" button, next to which a short notice is displayed. When they load, the visitor's browser connects directly to Google's servers, and Google receives at least the visitor's IP address, technical data of the browser, and the website (web address) from which the request originates. According to its own notice, Google may also use cookies or similar technologies for this purpose.

    Legal basis: the visitor's consent (Article 6(1)(a) GDPR), given by accepting the “Google content” category or by clicking the button. Consent given by clicking the button applies to that particular display: on moving to another page, the section shows the button again. Consent to the “Google content” category is remembered by the website – together with the other cookie choices – on the visitor's device, in the psh_consent cookie (Section 8.5), and it can be withdrawn at any time via the “Cookie settings” item in the footer. After withdrawal the website removes the element and the reviews already displayed, the section shows the button again, and an earlier click no longer applies; Google's program code already downloaded may remain in the browser until the page is reloaded. If the visitor neither consents nor clicks, their browser does not connect to Google because of the reviews; the reviews can also be viewed on Google's own site through the link in the section, where a review can also be written.

    Google processes the data it receives in accordance with its own privacy policy (policies.google.com/privacy). Google LLC operates in the United States of America and participates in the EU–U.S. Data Privacy Framework.

    15. Google Search Console and Bing Webmaster Tools

    The website may use Google Search Console and Bing Webmaster Tools for search engine optimisation and webmaster verification purposes. Their use relates to the administration of the website and to checking its indexing status, and on the website itself it amounts to placing, at most, a meta tag serving ownership verification.

    These systems do not collect visitors' personal data through the website, load no script and place no cookie; they therefore do not appear as a separate purpose of processing in relation to visitors.

    16. Processors and recipients

    For the operation of the website, the provision of hosting and the technical services, the controller uses the following processors.

    • Hosting provider: Hetzner Online GmbH (Germany) – operation of the website and of the back-end system (database, file storage)
    • Email delivery: Resend, Inc. (United States of America) – sending the internal notifications about quote and callback requests, as well as the confirmation emails sent to the data subject
    • Google services: Google Ireland Limited (Ireland) – Google Tag Manager, Google Analytics 4, Google Ads conversion measurement, Google reCAPTCHA v2, and the provision of the controller's corporate mailbox (Google Workspace), in which the notification emails about incoming enquiries appear

    The controller updates the above list of processors if the service providers it uses change. Under the GDPR, data subjects must be informed of the recipients or the categories of recipients.

    17. Transfers outside the EEA

    The controller endeavours to ensure that personal data are processed primarily within the European Economic Area (EEA). The website, its database and the uploaded files are stored in the European Union, in Germany, on the servers of Hetzner Online GmbH.

    Resend, Inc., which delivers the emails, operates in the United States of America; consequently the data required for email delivery (the recipient's name and email address and the content of the message) may also be transferred to the United States. Google Ireland Limited is a contracting party established in the European Union, but Google may also process data in the United States in the course of providing its services.

    In these cases the controller relies, as appropriate safeguards, on the data processing agreements concluded with the service providers and on the standard contractual clauses (SCC) adopted by the European Commission that form part of those agreements. A copy of the documentation of the safeguards applied may be requested from the controller at the contact details given in Section 1. The detailed data processing terms of each service provider are available in their own privacy policies.

    18. Summary of retention periods

    The controller retains data in accordance with their purpose. Where data are retained indefinitely, retention lasts until the data subject's request for erasure or successful objection (Section 19).

    • Quote request data: indefinitely, whether or not a contract results, until the data subject's request for erasure or successful objection; no automatic deletion takes place (Section 4.4)
    • Callback requests: indefinitely, until the data subject's request for erasure or successful objection; no automatic deletion takes place (Section 5.4)
    • Uploaded files: together with the quote request, indefinitely, until the data subject's request for erasure or successful objection; in the event of a request for erasure, they are also deleted from the file storage (Section 6.4)
    • Source data and outcome of the enquiry: together with the enquiry, indefinitely, until the data subject's request for erasure or successful objection (Sections 4.1, 4.3 and 4.4)
    • Technical logs: a maximum of 90 days
    • Aggregated arrival count: the raw log lines until the hourly aggregation, normally for at most about one hour (if an aggregation fails, until the next successful retry); the aggregated daily count contains no personal data and is therefore not subject to a retention limit (Section 7)
    • Aggregated Google Ads campaign data: contain no personal data and are therefore not subject to a retention limit (Section 11.3)
    • Google Analytics measurement data: 14 months for both event and user level data, stored within the Google Analytics service, with automatic deletion thereafter. Aggregated reports remain available beyond that, but they can no longer be traced back to an individual session.
    • Google Ads conversion data: according to Google’s own advertising measurement retention rules; the controller cannot set separate periods for these.
    • Cookie consent: stored exclusively on the visitor's own device, in the psh_consent cookie and in the browser's local storage, together with the timestamp of the choice and the version number of this policy; the lifetime of the cookie is 1 year. There is no server-side consent record.
    • Non-identifying event log: contains no personal data, and is therefore not subject to a retention limit; the exception is the log of the captcha checks (Section 7), which is deleted automatically after 90 days
    • Contractual data or data related to performance: for the duration of the related legal relationship, for the period necessary to document performance and to enforce legal claims, and in accordance with the legislation, in particular the accounting rules (Section 4.4)

    19. Rights of data subjects

    The data subject has the right to:

    • request information about the processing of their personal data,
    • request access to the data processed and obtain a copy of them,
    • request the rectification of inaccurate data,
    • request the erasure of their personal data,
    • request the restriction of processing,
    • exercise the right to data portability (Article 20 GDPR): to receive the data processed by automated means on the basis of consent or a contract in a structured, commonly used, machine-readable format and, where technically feasible, to have those data transmitted directly to another controller,
    • object to processing based on legitimate interest,
    • withdraw consent at any time where processing is based on consent; such withdrawal does not affect the lawfulness of processing carried out before the withdrawal,
    • lodge a complaint with the supervisory authority,
    • seek a judicial remedy.

    Requests may be submitted at the email address or postal address given in Section 1. The controller informs the data subject of the measures taken within one month of receipt of the request at the latest. These rights follow from Chapter III of the GDPR.

    Objection to processing based on legitimate interest: the data subject may object at any time, on grounds relating to their particular situation, to processing based on legitimate interest (Sections 4.3, 5.3, 6.3, 7, 8.2, 9 and 13.2). In that case the controller may no longer process the data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims. The objection may be submitted at the email address or postal address given in Section 1.

    20. Remedies

    If you believe that your rights have been infringed in the course of the processing of your personal data, you may lodge a complaint with the Hungarian supervisory authority, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH – Hungarian National Authority for Data Protection and Freedom of Information).

    • Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
    • Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
    • Postal address: 1363 Budapest, Pf. 9., Hungary
    • Phone: +36 (1) 391-1400
    • Email: ugyfelszolgalat@naih.hu
    • Website: naih.hu

    The data subject may also seek a judicial remedy before the competent court.

    21. Amendment of this privacy policy

    The controller reserves the right to amend this policy in the event of changes in legislation, technical modifications or the use of new service providers. The version in force at any given time is available on the website.

    Effective as of: 20 October 2026

    CallQuoteCallback