Privacy notice | nstudio

1. Data controller

This notice explains how the nstudio.hu website handles personal data: what we collect through its forms, why, who helps us process it, how long we keep it, and what rights you have. Each of our mobile apps has its own privacy policy.

Controller: Nagy Tamás, sole trader (egyéni vállalkozó), trading as nstudio
Address: Budapest, Hungary
Email: [email protected]

We have no data protection officer. Send any question about your data to [email protected].

2. What we collect

Quote form

When you send the quote form, we receive:

your name and, if you give it, your company;
your email address and phone number and, if you choose them, the best time to call and the language you'd like us to reply in;
the service you need and your answers about it, for example platforms, number of pages, your website's address, the tools you use, or a description in your own words;
if you add them, a link to a brief or designs, a budget range and timing;
that you confirmed reading this notice, and the language of the page you used.

Emergency form

When you send the emergency form, we receive:

the address of the affected website, the symptoms you tick and any details you add;
if you give them, your hosting provider and whether you can still log in to WordPress;
your name, email address and phone number;
that you confirmed reading this notice, and the language of the page you used.

Emails

If you write to [email protected], we receive your email address, your name if your email shows it, and what you write.

Free-text answers contain whatever you choose to write, so please include only what we need to answer you. Your name, email address and phone number are required on both forms: without them we can't reply.

Technical data

Like any website, the servers that deliver these pages receive your IP address, browser details and the pages you request. When you send a form, we also use your IP address and the email address you entered to protect the forms from spam and abuse (see section 3).

3. Purposes, legal bases and retention

Answering your enquiry

Purpose: To answer your enquiry, prepare a written plan and quote, or help with a hacked website.
Data: The form answers and emails described in section 2.
Legal basis: Steps taken at your request before entering into a contract (GDPR Article 6(1)(b)). If you contact us on behalf of a company, our legitimate interest in answering business enquiries (Article 6(1)(f)).
Retention: 1 year after our last exchange, unless a contract follows. If it does, we keep the correspondence for as long as the contract and the legal obligations attached to it require.

Spam protection on the forms

Purpose: To check, with Cloudflare Turnstile, that a form is sent by a person and not a bot.
Data: Your IP address and technical signals from your browser and device, which Cloudflare evaluates during the check.
Legal basis: Our legitimate interest in keeping our forms and mailbox free of spam and abuse (Article 6(1)(f)).
Retention: We don't store the data of the check. Cloudflare processes it only to run the check.

Limiting repeated submissions

Purpose: To limit how many forms can be sent from one IP address, or with one email address, within 15 minutes.
Data: Your IP address and the email address you entered, kept as counters.
Legal basis: Our legitimate interest in protecting the forms from abuse (Article 6(1)(f)).
Retention: The counters are deleted automatically after 15 minutes.

Delivering and securing the website

Purpose: To deliver the pages to you and protect the website from attacks.
Data: IP address, browser details, the requested page and the time of the request.
Legal basis: Our legitimate interest in running a secure website (Article 6(1)(f)).
Retention: In our providers' technical logs, for a limited time and under their own terms.

4. Who processes the data for us

We use these service providers (data processors). They process personal data only on our behalf and for the purposes above.

Cloudflare, Inc. (USA): Delivers and protects the website (CDN) and runs the Turnstile spam check on the forms. Every visit to the website passes through Cloudflare.
Brevo (France): Delivers the form submissions to our mailbox by email.
Hostinger International Ltd. (Cyprus): Hosts the website on servers in the EU, and hosts our email mailbox.

Cloudflare is based in the United States. Transfers to it rely on the EU–US Data Privacy Framework, under which Cloudflare is certified, and on the standard contractual clauses in its data processing terms.

We don't sell your data or pass it to anyone else, unless the law requires us to (for example, at an authority's request).

5. Cookies

This website uses no analytics or advertising cookies, and we don't track you on other websites. It only uses what it needs to work:

a language-preference cookie, which remembers whether you chose English or Hungarian;
Cloudflare Turnstile on the forms, which checks your browser to keep spam out.

You can see this list at any time under Cookie settings, at the bottom of every page.

6. Your rights

You can ask us, free of charge:

to tell you what personal data we hold about you and how we use it, and to give you a copy (access);
to correct inaccurate data (rectification);
to delete your data when we no longer need it or have no legal ground to keep it (erasure);
to restrict processing, for example while we check a correction you asked for (restriction);
to give you the data you provided, for a contract or the steps before one, in a machine-readable format (portability);
to stop processing based on our legitimate interest, unless we have compelling legitimate grounds to continue (objection).

Send your request to [email protected]. We may ask you to confirm your identity. We answer within one month. For complex requests this can be extended by two further months, and we'll tell you if it is.

We make no automated decisions about you and don't profile you.

7. Complaints

If you think we've handled your data unlawfully, please tell us first at [email protected] so we can put it right. You can also complain to the Hungarian data protection authority:

Authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
Postal address: 1363 Budapest, Pf. 9.
Phone: +36 1 391 1400
Email: [email protected]
Website: www.naih.hu

You can also go to court. In Hungary, you can bring the case before the regional court (törvényszék) of your place of residence or stay. If you live or work in another EU country, you can also complain to the data protection authority there.

8. Changes to this notice

We update this notice when the way we handle personal data changes. The date at the top shows the current version.

Privacy notice (Adatkezelési tájékoztató)