Privacy policy

This policy explains what personal data I process on the bthamas.hu website and in the course of my services, what I use it for, how long I keep it, who I share it with, and what rights you have. It was prepared under the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Hungarian Act CXII of 2011 on informational self-determination and freedom of information (Infotv.). The Hungarian version is authoritative; this English version is a translation for convenience.

1. The controller

Name

Balogh Tamás Szilveszter e.v. (sole trader, Hungary)

Registered address

9012 Győr, Galgóczi Erzsébet utca 20–22. B lph. fsz. 2.

Registration no.

58271179

Tax no.

44504407-1-28

Email

bthamas.dev@gmail.com

Phone

+36 30 411 8340

Website

https://bthamas.hu

I am not required to appoint a data protection officer. For any data protection question, write to me directly at the email address above.

2. In short

• I only ask for the data a given purpose needs – in most cases your name and email address.
• No tracking or advertising cookies, and I never sell or rent out your data. I measure visits with my own cookie-free analytics that doesn’t identify you (section 3.9).
• I don’t store your IP address: to filter out abuse I only use a one-way fingerprint of it, made with a secret key.
• I don’t send newsletters. Anything you consented to can be withdrawn with a single reply.
• I keep data only for the periods below; when they expire, the system deletes it automatically.

3. What I process and why

3.1. Using the website

Data

IP address, browser type, the page requested and the time (server log); a one-way fingerprint (hash) of the IP address made with a secret key.

Purpose

running the website securely, finding errors, and filtering out overload and abuse (e.g. mass automated requests).

Legal basis

my legitimate interest in operating the website securely (GDPR Art. 6(1)(f)).

Retention

in the hosting provider’s logs according to its rules, for a short time (typically a few days); the request counters using the fingerprint are deleted after 2 days.

3.2. Free website audit

Data

the web address you enter, the result and a public screenshot of the audited page; a fingerprint of your IP address; if you ask for the full report, your name and email address.

Purpose

running the measurement and showing the report; with your name and email, sending you the report link and – if I see something worth fixing – one tailored quote related to that report.

Legal basis

for the measurement, my legitimate interest in running the free tool you requested (Art. 6(1)(f)); for your name and email, your consent (Art. 6(1)(a)), given by entering and submitting them. You can withdraw it at any time – a single reply (“unsubscribe”) is enough – without affecting the lawfulness of earlier processing.

Retention

the result for 12 months; your name and email until you withdraw consent, at most 12 months. If you request a quote or book a call in the meantime, sections 3.3 and 3.4 apply.

Recipients

Google PageSpeed Insights measures the web address and Cloudflare’s security DNS filter checks the domain name – neither receives your name or email. Anyone you forward the report link to can open it: the report contains the web address and the result, not your name or email.

3.3. Getting in touch and quote requests

This covers a plan sent from the Price calculator, a quote request after an audit, a request for a manual audit, and contacting me by email, phone or WhatsApp.

Data

name, email address, phone number (if you give it or call me), your message – for emails, the text of the email and the names and sizes of its attachments –, the selected plan or report and – if you give them – your business’s name and website; when you submit a form, a fingerprint of your IP address (against abuse).

How

your replies to my emails arrive in my own client management system (the reply address is a dedicated subdomain, such as …@uzenet.bthamas.hu), where I see them in the history that belongs to you.

Purpose

replying, understanding your needs, preparing a quote and keeping in touch about it.

Legal basis

steps taken at your request before entering into a contract (Art. 6(1)(b)); if you contact me on behalf of a business, my legitimate interest in business communication (Art. 6(1)(f)).

Retention

if no contract is concluded, 2 years from the last contact, after which the system deletes it automatically; if one is, see section 3.5.

Recipients

if I assign your request to a sales associate, they can see it too (section 4). Messages sent via WhatsApp are also subject to WhatsApp’s (Meta’s) own privacy terms.

3.4. Booking a consultation

Data

name, email address, the chosen time, the topic (if you give one), a fingerprint of your IP address (against abuse) and my notes on the call.

Purpose

organising and holding the 20-minute consultation: confirmation and calendar invitation (with the Google Meet link), a reminder about 1 hour before, rescheduling and cancelling.

Legal basis

steps taken at your request before entering into a contract (Art. 6(1)(b)).

Retention

12 months from the time of the call, after which the system deletes it automatically, from Google Calendar too – unless you have become a client in the meantime (sections 3.5 and 3.6).

Recipients

if Google Calendar is connected, the booking’s time, your name, email and topic are added to my Google Calendar – your name and email as a guest, so Google sends you the calendar invitation (with the Google Meet link) and notifies you of any change or cancellation.

3.5. Quotes, contracts and invoicing

Data

name, business name, contact person, email address, phone number, billing address, tax number; the content and price of the quote; the time of acceptance, the accepted version of the Terms, your note and a fingerprint of your IP address (as proof of acceptance); correspondence about the work.

Purpose

concluding and performing the contract, invoicing, and proving the rights and obligations arising from it.

Legal basis

performance of the contract (Art. 6(1)(b)); my accounting and tax obligations (Art. 6(1)(c) – Section 169 of Hungarian Act C of 2000 on Accounting, Act CXXVII of 2007 on VAT); establishing and defending legal claims (Art. 6(1)(f)).

Retention

5 years after the contract ends (the general limitation period under Section 6:22 of the Hungarian Civil Code); accounting documents such as invoices for 8 years.

3.6. Client relationship

Data

the data listed in sections 3.3–3.5, the details of our projects, related notes, and copies of the quotes and emails sent, and of the emails you send me.

How

a writing software service may help me draft my emails and quotes: in that case it receives the part of our correspondence needed for the reply (section 4). I review and send every email and quote myself – there is no automated decision-making (GDPR Art. 22).

Purpose

organising our work, keeping earlier agreements retrievable, maintaining and extending the system.

Legal basis

performance of the contract (Art. 6(1)(b)) and my legitimate interest in keeping a record of the client relationship (Art. 6(1)(f)).

Retention

for the duration of our cooperation and 5 years after our last contract ends.

3.7. Business outreach: potential clients

I also reach out to small businesses that – based on their public data – could benefit from a new website or booking system. If that is how we got in touch, this section is for you (GDPR Art. 14).

Data

the business’s name, address, activity, publicly listed phone number and email address, its website and that website’s technical state (e.g. whether it works or is mobile-friendly), the number and average of its public reviews, notes on the outreach, and, if you agreed to receive an email, how and when you agreed; if I build a demo page for you, how you viewed it (section 3.11). This is mostly company data – for a sole trader, however, it may qualify as personal data.

Source

public, open business directories (OpenStreetMap, Overture Maps) and the business’s own website.

Purpose

assessing whether I can help the business, and a personal approach – by phone first.

Legal basis

my legitimate interest in presenting my services to businesses (Art. 6(1)(f)). Balancing test: I only use public data published for business purposes, I only contact businesses, I never send unsolicited advertising emails – only emails you agreed to beforehand (for example by phone), which I record – and you can object in a single sentence.

Retention

unprocessed results are deleted after 30 days; data on businesses marked or contacted is kept for at most 12 months if no cooperation follows. If you object, I delete your data and keep only an identifier so you won’t be contacted again.

Recipients

the associate I assign the outreach to, and the software services used to organise the results (section 4).

Objection

you can object at any time without giving reasons (GDPR Art. 21): write to bthamas.dev@gmail.com or just tell me during the call.

3.8. When I access your clients’ data

If on your behalf I build, run or maintain a system that processes your clients’ data (such as a booking system or a CRM), you are the controller of that data and I act as your processor, on your instructions. The data processing annex of the Terms applies; your own privacy policy informs the data subjects.

3.9. Website analytics

Data

which pages you view and for how long (active time), how far you scroll, how long each part of a page is on screen, where you click on the page (the button or link label and the position of the click – never what you type into a form), where you came from (the referring site’s domain, campaign tags), your device type and screen width, the name of your browser and operating system, and your country and city (derived from your IP address at the moment of the request). If you submit a form, also that the visit reached a goal (for example a booking) – not the form’s content.

How

without cookies and without any identifier stored in your browser. The pages of one visit are linked by a daily key: a one-way fingerprint of your IP address and browser details, made with a secret salt that changes every day. I don’t store the IP address, and the salt is destroyed every midnight, so the measurement doesn’t identify you or follow you across days. I never link this data to your name, email address or anything else that identifies you.

Purpose

improving the website: seeing which pages and sections work, where visitors get stuck and what they would like to click.

Legal basis

my legitimate interest in improving the website (Art. 6(1)(f)). You can object: if your browser sends a “do not track” signal (Global Privacy Control or Do Not Track), the measurement doesn’t start at all – and you can also ask me by email.

Retention

page views for 13 months, clicks for 6 months; after that the system deletes them automatically.

Recipients

no one; Vercel (hosting) and Turso (database) store it as processors (section 4).

3.10. Whether my emails are opened

Data

for the emails I send you (quote, report, confirmations, reminder, my emails and replies): whether and when you opened them – from the download of an invisible 1×1 pixel image –, how many times, whether and when you clicked one of their links – the links pass through my own redirect –, and for quotes, whether you viewed the quote page. I only use the type of your email program to filter out automatic downloads (for example by mail filters); I don’t store it.

Purpose

knowing whether what I sent – a quote, for example – arrived and was read, so I don’t bother you with needless follow-ups, and seeing which of my emails are useful.

Legal basis

my legitimate interest in following up my client relationships and quotes (Art. 6(1)(f)). You can object: reply to any of my emails and I’ll switch it off for the emails sent to you. If your email program doesn’t load images automatically, opens aren’t visible anyway.

Retention

together with the other data about the recipient (sections 3.2–3.7); 90 days for test emails.

3.11. Demo pages

If I build a demo page for you – for example to show what your new website could look like – I send its link to you personally.

Data

whether and when you opened it, how long you viewed it (active time), how far you scrolled, which parts you looked at the longest, what you clicked on it (the button or link label – never what you type into a form), your device type, the name of your operating system and your city (derived from your IP address at the moment of the request; I don’t store the IP address). The measurement is tied to the link sent to you, so – unlike the analytics in section 3.9 – I know it was you who viewed it. It uses no cookies.

Purpose

seeing whether the demo interests you, and which part of it – so my approach or quote fits what you actually need, and I don’t bother you needlessly.

Legal basis

my legitimate interest in following up my quotes (Art. 6(1)(f)). You can object: if your browser sends a “do not track” signal (Global Privacy Control or Do Not Track), the measurement doesn’t start at all – and you can also ask me in a reply.

Retention

views for 12 months; the demo page together with the outreach or client data (sections 3.3, 3.7) – for at most 12 months if no cooperation follows.

Recipients

no one; Vercel (hosting) and Turso (database) store it as processors (section 4).

4. Who can access the data?

I am the controller. Apart from me, access is limited to:

• my sales associates – only to the requests and cases assigned to them, bound by confidentiality, on my instructions;
• the processors below – only to the extent needed for their task, under their data processing terms;
• software services used to draft emails and quotes, and to organise and analyse potential clients’ data (section 3.7) (including in the USA) – only for the part of the correspondence needed for a given reply, and for public business data;
• authorities or courts – where the law requires it.

I never sell your data or share it with anyone for marketing purposes.

5. Transfers outside the European Economic Area

Some processors operate in the United States (marked in the table). Transfers rely on the European Commission’s adequacy decision on the EU–US Data Privacy Framework where the provider participates in it (e.g. Vercel), and otherwise on the Standard Contractual Clauses adopted by the European Commission (GDPR Art. 46(2)(c)), included in the providers’ data processing agreements.

6. Cookies and data stored in your browser

The public pages use no cookies and no advertising or social tracking code; even the fonts load from my own server, and the website analytics (section 3.9) stores nothing in your browser. Your browser’s session storage – which is cleared automatically when you close the tab – may hold a few items needed for features you use:

These stay on your device and only reach me if you submit a form. As they are strictly necessary for features you requested, they require no consent (Section 155 of Hungarian Act C of 2003 on Electronic Communications).

The admin area – used only by members of my team – uses the cookies needed to sign in: bt_s / __Host-bt_s (session, up to 30 days), bt_gstate (Google connection, 10 minutes), bt_lm (sign-in address, 2 minutes).

7. Security

• Every page is served over an encrypted (HTTPS) connection.
• Data can only be accessed after signing in, according to permissions (password, passkey); passwords and sign-in tokens are stored only as fingerprints.
• Instead of IP addresses I store a one-way fingerprint made with a secret key.
• Secret links (report, booking management, quote) use random, unguessable identifiers.
• Regular backups are made; the processors store data encrypted.

Should a personal data breach occur, I act under GDPR Articles 33–34: I notify the supervisory authority within 72 hours and, if the breach is likely to result in a high risk to you, I inform you as well.

8. Your rights

• Access (Art. 15): ask whether I process your data and, if so, get a copy and the details of the processing.
• Rectification (Art. 16): have inaccurate data corrected and incomplete data completed.
• Erasure (Art. 17): have your data deleted – unless the law requires me to keep it (e.g. invoices).
• Restriction (Art. 18): ask me to only store your data for a while, without using it.
• Portability (Art. 20): receive the data you provided, processed on the basis of consent or contract, in a machine-readable format (JSON).
• Objection (Art. 21): object to processing based on legitimate interest; to business outreach (section 3.7) without giving reasons.
• Withdrawing consent (Art. 7(3)): at any time, without affecting the lawfulness of earlier processing.

Send your request to bthamas.dev@gmail.com, or by post to my registered address (9012 Győr, Galgóczi Erzsébet utca 20–22. B lph. fsz. 2.). I reply within one month at the latest; for complex requests this may be extended by two months, in which case I let you know within the first month. Replies are free of charge. If I have reasonable doubts about your identity, I may ask for additional information to confirm it.

Automated decision-making: I make no decisions about you based solely on automated processing that would have legal effects. The audit score rates websites, not people.

9. Remedies

If you feel I have infringed your rights, please write to me first – I will try to put it right straight away. You can also lodge a complaint with the supervisory authority:

Authority

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

Address

1055 Budapest, Falk Miksa utca 9–11., Hungary

Postal address

1363 Budapest, Pf. 9.

Phone

+36 1 391 1400

Email

ugyfelszolgalat@naih.hu

Website

naih.hu

You may also go to court; at your choice, proceedings can be brought before the regional court (törvényszék) of your place of residence or stay (GDPR Art. 79, Infotv. Section 23). If you live in another EU member state, you can also complain to the supervisory authority there.

10. Other provisions

Minors. My services are intended for businesses; I do not knowingly process the data of anyone under 16.

Changes to this policy. If my data processing changes, I update this policy; the date of the version in force is shown at the top of the page. If a change affects you, I also let you know by email.