Privacy notice

Sárosi Boldizsár Dániel, sole proprietor, Sárosi Sites.

• Registered office: 5720 Sarkad, Hargita sétány 4.
• Registration number: 62777551.
• Tax number: 92352704-1-24.
• Email: web@sarosisites.hu.
• Phone: +36 70 558 2727.
• Website: https://sarosisites.hu.

You may send a data protection request by email or to the postal address above.

Visits to the website, quote requests and communication, and work and invoicing based on an accepted quote. The public quote request is a non-binding enquiry: it does not create an order or contract, and there is no online payment. An agreed offer can be accepted on a separate, invitation-only electronic acceptance page (see section 4). Separate notices apply to the processing of data on websites created for my clients.

Requesting a quote is not an order, does not create a payment obligation and is not a newsletter subscription. Please do not include passwords, card details, health data or other special-category data in the free-text field.

Purpose: answering the request, assessing requirements and preparing an individual quote. I respond personally within 1 business day at the latest; the automatic email only acknowledges receipt.

Data processed: name, email address and message (required), together with the selected service, whose default is “Not sure yet / individual requirements”. Optional data: phone number, company name, existing website, domain/hosting situation, available materials, requested functions, planned launch and budget. The system also records a submission identifier, receipt time and data-structure version to recognise accidental duplicates and ensure safe processing.

Legal basis: GDPR Article 6(1)(b) for an individual taking steps towards a contract in their own name. For a company contact or a general question unrelated to a contract, GDPR Article 6(1)(f): the requested business communication and answering the enquiry; you may object on grounds relating to your particular situation.

Data flow: the quote request form sends the supplied data directly to an HTTPS receiver hosted by Rackhost. The receiver records the quote request in my owner-only client register on Rackhost hosting and in Make. Make uses Rackhost's email service to send an internal notification to me and a confirmation to the supplied email address. The contents of the quote request do not pass through a Lovable server function. Messages from my own mailbox are also forwarded to my free consumer Gmail account, while the original copy is retained.

Retention: I retain data from quote requests that do not lead to an order for 6 months after the matter is closed (a rejected or unsuccessful quote, or a closure decision recorded by me). I review the data monthly and manually delete expired data from the Rackhost client register, the Make register, Rackhost and Gmail email copies, and related exports, so deletion takes place within at most one further month after the 6-month period expires. There is no automatic deletion. Where a contract is concluded, or for invoices or a specific legal dispute, I separately process the necessary data for the legally required period connected with the relevant purpose.

Purpose and data: identifying the client and contact person; keeping records of the quote, discussions, development, handover, fee and payment status, content-change occasions and package changes. Client register (CRM) data: client and contact details, offer and order details, the reference of the issued NAV invoice, payment verified by me, and records of performance/delivery. I do not process card details and there are no automatic payments; I record invoices, payments and delivery manually.

Invitation-only electronic acceptance: an agreed offer can only be accepted on a separate page reached through an invitation link. I record the fixed, unchangeable Hungarian contract/offer version, the typed full legal name, the explicit acceptance statement and the representation or own consumer-order declaration, verification of a six-digit one-time code sent by email (valid for 10 minutes, at most 5 failed attempts) and the time of acceptance. This is not a qualified electronic signature, qualified identification or qualified time stamp. A consumer may separately request that performance begin within the withdrawal period and separately acknowledge losing the right of withdrawal upon full performance; neither is automatic.

Withdrawal declaration: the public withdrawal page asks for the declaration, name, email address and contract reference, with two-step confirmation; I keep a durable record and send a receipt.

Storage and access: this data is kept in an SQLite database on Rackhost hosting that only I can access, and notifications are sent through Rackhost email (SMTP); I do not store it in Lovable. The portal's own notice: ajanlat.sarosisites.hu/crm/privacy.php.

Legal basis: conclusion and performance of a contract (GDPR Article 6(1)(b)); legal obligation (c), for example invoices and handling withdrawals; legitimate interest (f) in establishing, exercising or defending legal claims and in the security of the pages; legitimate interest for a company contact.

Retention: for the time needed for performance and to track commitments (such as free content changes). Contract-conclusion and withdrawal evidence is generally kept for 5 years after the relationship closes, or until a pending or expected claim is resolved. Invoices follow the tax retention in section 5. I do not promise automatic deletion; expired data is deleted manually.

Purpose: issuing invoices, monitoring payments and fulfilling tax obligations. Data processed: billing name and address, tax number where necessary, service, fee, performance and invoice data, payment method and transaction identifier. For bank transfers, payer details and the payment reference supplied by the bank may also become known.

I, Sárosi Boldizsár Dániel, personally issue and manage every invoice using NAV Online Számlázó. Bank transfers and cash are accepted. For card payments, I send a Revolut Pro payment link for the specific amount set out in the accepted quote; the client pays on Revolut's website. The quote request form does not ask for card details. The accountant is not given access to client data or invoices.

Legal basis: GDPR Article 6(1)(c) for mandatory invoicing and tax records.

Retention: for the period required for retaining records under section 78 of the Act on the Rules of Taxation, until the right to assess tax is time-barred.

The quote request system validates fields, limits request size, and uses a hidden honeypot field, a minimum completion time and rate limiting. For rate limiting, the Rackhost receiver processes a pseudonymised identifier derived from the connection IP address using a secret key, together with request timestamps. I do not store the raw IP address in this limiter or forward it to Make. Expired entries are removed by scheduled cleanup running every five minutes; they may remain in the file until the next successful run.

Hosting, automation and email providers may process technical logs for security and operational purposes under their own published policies; where they do not publish the exact retention period, I cannot specify it. Make Pro execution logs are available for 30 days, and webhook logs for 3 days (Make pricing, Make webhooks); these are separate from the stored quote request register, to which the retention rules in section 3 apply.

Legal basis: legitimate interest in secure operation and preventing misuse (GDPR Article 6(1)(f)). I do not log the contents of quote requests for debugging.

Within the business, only I, Sárosi Boldizsár Dániel, have human access to client data, invoices, quote requests, client correspondence and project materials. There are no other staff members, and the accountant is not given access to these. The technical providers listed below (hosting, automation and email) may also process data in their contractually defined roles necessary for operation.

Lovable

Delivery of the main website through a global Cloudflare/CDN layer and the related technical visit and security data, in accordance with the Lovable privacy policy. Responsible entity for data protection: Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden; privacy@lovable.dev. The contents of quote requests do not pass through a Lovable server function. The Pro plan I use does not include a customer data processing agreement (DPA).

Make / Celonis, Inc.

Maintaining the quote request register and automating email delivery, as a data processor. The Make general agreement incorporates the data processing agreement.

Rackhost Zrt.

The HTTPS receiver for quote requests, hosting for my owner-only client register (SQLite) and the contract acceptance and withdrawal pages, domain services, email (SMTP) and mailbox. 6722 Szeged, Tisza Lajos körút 41.; info@rackhost.hu. The Rackhost data processing annex applies together with the main service contract or order (section 18.1), without a separate signature.

Google / Gmail

Forwarding messages from my own mailbox to my free consumer Gmail account, under Google's terms and privacy policy. According to Google's information, consumer Gmail accounts have no customer DPA and Google does not act as a data processor in this context (source).

NAV

Online Számlázó, invoices and tax authority functions; acting in its own role as a public authority.

Revolut

For card payments, payment takes place on Revolut's website through a Revolut Pro payment link sent for the amount of the accepted quote; Revolut processes the payer and transaction data.

The listed providers do not all process data in the same role: authorities, banks and certain consumer services act as controllers in their own right.

Lovable, Make and Google are international services, so data may also be processed outside the European Economic Area. The providers apply the necessary safeguards (such as standard contractual clauses (SCC) adopted by the European Commission or an adequacy decision) in accordance with their own privacy notices and data processing agreements.

The website's own code does not use analytics or advertising cookies, localStorage or sessionStorage, and does not embed external content. Lovable visitor analytics is turned off. The hosting providers may use technical cookies (__dpl, __cf_bm). The separate client portal (/crm/) uses essential session cookies (sarosi_crm, SAROSISIGN, SAROSIWITHDRAW) that are not used for tracking; details are in the Cookie notice.

I personally decide on quotes and whether to undertake a project. The automatic confirmation is not a contractual decision, and there is no solely automated decision-making producing legal effects.

You may request access to your data, rectification, erasure, restriction of processing and data portability; you may object to processing based on legitimate interest. Records that must be retained cannot always be erased. Requests: web@sarosisites.hu. As a rule, I respond within one month; if an extension is justified, I inform you within the first month. The rights and deadlines are governed by GDPR Articles 12–22.

You may submit a complaint to NAIH or seek a remedy before a court. NAIH: 1055 Budapest, Falk Miksa utca 9–11.; 1363 Budapest, Pf. 9.; ugyfelszolgalat@naih.hu; official contact details. You do not need to complain to me first.

I update this notice when the actual processing changes, with a new version number and effective date.