Privacy policy

1. Introduction

DataCrew Kft. (Kert utca 15., 8220 Balatonalmádi, Hungary; VAT number: 27120352-2-19; company registration number: 19-09-520863) — hereinafter the Service Provider or controller — processes personal data as set out in this policy.

We provide the following information in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, hereinafter GDPR).

This privacy policy governs the processing carried out on the datacrew.agency website. It is available at datacrew.agency/en/privacy-policy/. The controller reserves the right to amend this policy and will inform data subjects in good time.

The controller is committed to respecting the right to informational self-determination and treats the personal data that comes to its knowledge as confidential.

2. The controller and its contact details

• Name: DataCrew Kft.
• Registered seat and postal address: Kert utca 15., 8220 Balatonalmádi, Hungary
• Email: [email protected]
• Phone: +36 70 544 6727
• VAT number: 27120352-2-19
• Company registration number: 19-09-520863
• Website: datacrew.agency

The controller is not required to appoint a data protection officer.

3. Definitions

• Personal data: any information relating to an identified or identifiable natural person (data subject).
• Processing: any operation performed on personal data, such as collection, recording, storage, use, transfer or erasure.
• Controller: the party that determines the purposes and means of the processing of personal data.
• Processor: the party that processes personal data on behalf of the controller.
• Consent of the data subject: any freely given, specific, informed and unambiguous indication of the data subject's wishes.
• Third party: a natural or legal person other than the data subject, the controller or the processor.
• Personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, unauthorised disclosure of, or access to, personal data.

4. Principles of processing

We process personal data lawfully, fairly and in a transparent manner. We collect data only for specified, explicit and legitimate purposes and do not process it in a manner incompatible with those purposes.

We process data that is adequate and relevant to the purposes of the processing, and limited to what is necessary (data minimisation). Data must be accurate and kept up to date; inaccurate data is erased or rectified without delay.

We store personal data in a form which permits identification of data subjects for no longer than is necessary, and we ensure its security with appropriate technical and organisational measures.

5. Contact and free measurement audit requests

Two forms are available on the website: the general contact form on the Contact page, and the application for a free measurement audit on the Free measurement audit page. Both are served by the Phonevert system, which is also operated by DataCrew Kft..

1. Data processed and purpose: first and last name (contact, identification), email address (keeping in touch), phone number (keeping in touch), company name and website address (preparing the quote or the audit), the content of the message (answering the enquiry), the time and IP address of submission (technical operation, abuse prevention), and the campaign source preceding the enquiry (see the section on cookies).
2. Data subjects: everyone who submits a form on the website.
3. Legal basis: Article 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract), and Section 13/A(3) of Hungarian Act CVIII of 2001 on electronic commerce services.
4. Duration: 5 years after the enquiry is closed (the general limitation period under Section 6:22 of the Hungarian Civil Code), or until the data subject requests erasure. Where accounting documents arise from the cooperation, those are retained for 8 years under Section 169(2) of Hungarian Act C of 2000 on accounting.
5. Who may access the data: authorised staff of the controller and the processors listed in this policy.
6. Consequence of not providing the data: completing the form is voluntary, but without the data we cannot answer the enquiry.

Besides the forms you can also reach us by email and phone; data provided that way is processed for the same purpose and for the same duration.

6. Cookies

A cookie is a small data file placed on the visitor's device by the website. Some cookies are essential for the website to work; others serve statistical or marketing purposes.

The website operates a consent management platform (CMP): on your first visit we inform you about cookies and ask for your consent to place non-essential ones. Without consent, statistics and marketing cookies are not placed (Google Consent Mode v2, denied by default).

You can change your choice at any time via "Cookie settings" in the footer. You can also delete or block cookies in your browser settings; in that case some features of the website may not work as expected.

Cookies actually used on the website:

Legal basis: for strictly necessary cookies, the legitimate interest of the controller (Article 6(1)(f) GDPR); for all other cookies, the consent of the data subject (Article 6(1)(a) GDPR).

7. Google Analytics

The website uses Google Analytics 4, via Google Tag Manager and a server-side container (server-side tagging). This means measurement data first reaches our own server running on the s2.datacrew.agency domain, and is forwarded to Google from there.

Data processed: the time of the visit, the sub-pages viewed, the referring page, the device and browser type, approximate geographic location (city level), and a randomly generated visitor identifier stored in a cookie.

Purpose: analysing traffic and usage of the website, improving our content and services.

Legal basis: consent of the data subject (Article 6(1)(a) GDPR). Without consent, Google Analytics places no cookie and only aggregated data unsuitable for identification is transmitted (Consent Mode v2).

You can read about Google's data processing practices at policies.google.com/privacy. A browser opt-out add-on for Google Analytics is also available.

8. Meta Pixel and joint controllership

The Meta Pixel advertising measurement tool has been integrated into the website but is currently not activated — it places no cookie and transmits no data. The information below is provided in case we switch measurement on in the future; we will announce that by updating this policy.

Data processed (if activated): the fact and time of the visit, the sub-pages viewed, device and browser data, and an identifier stored in a cookie.

Purpose: measuring and optimising the effectiveness of our advertising.

Legal basis: consent of the data subject (Article 6(1)(a) GDPR).

Where the Meta Pixel is used, the controller and Meta Platforms Ireland Ltd. qualify as joint controllers under Article 26 GDPR for those processing operations whose purposes and means they determine jointly. The essence of the joint controller arrangement is available on Meta's site. Meta is responsible for providing the information required under Articles 13 and 14 GDPR; the data subject may exercise their rights with either controller.

9. Recipients with whom personal data is shared (transfers)

We transfer personal data only to the processors named in this policy and — where required by law — to authorities. We do not sell or pass on data to third parties for marketing purposes.

Some of our processors also carry out processing outside the European Economic Area (in the United States). In those cases the legal basis for the transfer is an adequacy decision of the European Commission (EU–US Data Privacy Framework), or the standard contractual clauses adopted by the European Commission, with supplementary safeguards.

10. Processors engaged

Data processed: all personal data provided by the data subject, and technical data generated automatically while using the website.

Duration: until the agreement between the controller and the processor ends, or until the data subject requests erasure.

Legal basis: Article 6(1)(c) and (f) GDPR, and Section 13/A(3) of Hungarian Act CVIII of 2001.

11. Social media presence

The controller maintains a LinkedIn, a Facebook and a GitHub presence, reachable from the website footer. The website contains no tracking code from those platforms; the footer links are plain hyperlinks that take the user away from the website.

Processing on social platforms is governed by the privacy policy of the platform concerned. In connection with content published there, the controller may become aware of the publicly available data of data subjects.

12. Client relations and other processing

If a question arises while using the controller's services, or a data subject has an issue, they may contact the controller using the details given in this policy.

Emails and messages received, and data provided by phone — together with the enquirer's name, email address, phone number and any other data volunteered — are erased no later than 5 years after the matter concerned is closed.

Browsing the public content of the website requires no personal data. Technical data that automatically comes to the controller's knowledge during a visit (IP address, time of visit, sub-pages viewed) is used for security monitoring of the system.

We provide information about any processing not listed in this policy at the time the data is collected.

13. Rights of data subjects

1. Right of access. You have the right to obtain confirmation as to whether your personal data is being processed and, if so, access to that data and to the information listed in the GDPR.
2. Right to rectification. You may request that we rectify inaccurate personal data concerning you without undue delay, and that incomplete data be completed.
3. Right to erasure. You may request that we erase personal data concerning you without undue delay where one of the conditions set out in the GDPR applies.
4. Right to be forgotten. Where the controller has made the personal data public and is obliged to erase it, it takes reasonable steps to inform other controllers of the erasure request.
5. Right to restriction of processing. You may request restriction where you contest the accuracy of the data; where processing is unlawful but you oppose erasure; where we no longer need the data but you require it for legal claims; or where you have objected to the processing.
6. Right to data portability. You have the right to receive the data you provided to us in a structured, commonly used, machine-readable format, and to transmit it to another controller.
7. Right to object. Where processing is based on legitimate interest, you may object at any time on grounds relating to your particular situation.
8. Objection to direct marketing. Where data is processed for direct marketing purposes, you may object at any time; the data may then no longer be processed for that purpose.
9. Automated decision-making. You have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you. The controller does not apply automated decision-making or profiling in the processing described in this policy.
10. Right to withdraw consent. Where processing is based on consent, you may withdraw it at any time; this does not affect the lawfulness of processing before the withdrawal.

You can exercise your rights at the following contact points: by post at Kert utca 15., 8220 Balatonalmádi, Hungary, by email at [email protected].

14. Deadline for action

The controller informs you of the action taken on the above requests without undue delay and in any event within 1 month of receipt of the request. Where necessary, that period may be extended by two further months, of which we will inform you within one month of receiving the request.

If the controller does not take action on the request, it informs you without delay and at the latest within one month of receipt of the reasons for not taking action, and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

15. Security of processing

Taking into account the state of the art, the costs of implementation and the nature and risks of the processing, the controller and its processors implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These measures include, among others, encrypted transmission of data (HTTPS), restriction and logging of access, regular updating of systems, and ensuring the confidentiality, integrity, availability and resilience of processing systems.

Please note that data transmission over the internet cannot be regarded as fully secure. The controller does everything it can to make its processes secure, but cannot accept full responsibility for the security of data transmitted through the website.

16. Personal data breach

Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller informs the data subject of the breach without undue delay, describing its nature and the measures taken in clear and plain language.

The controller notifies a personal data breach to the Hungarian National Authority for Data Protection and Freedom of Information without undue delay and, where feasible, no later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

17. Right to lodge a complaint

A complaint about a possible infringement by the controller may be lodged with the Hungarian supervisory authority:

• Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information)
• Seat: Falk Miksa utca 9-11., 1055 Budapest, Hungary
• Postal address: 1363 Budapest, Pf.: 9., Hungary
• Phone: +36 (1) 391-1400
• Email: [email protected]
• Website: naih.hu

Data subjects may also bring the matter before a court. Proceedings fall within the competence of the regional court and may, at the data subject's choice, be brought before the court of their place of residence or stay.

18. Closing remarks

This policy was drawn up having regard to the GDPR, Hungarian Act CXII of 2011 on informational self-determination and freedom of information, Hungarian Act CVIII of 2001 on electronic commerce services, and Hungarian Act V of 2013 on the Civil Code.

Balatonalmádi, 27 August 2026