Privacy Policy

1. Data controller

Rosavallis Solutions Kft. (1145 Budapest, Róna utca 229. 1/1, Hungary, registration number: 01-09-458807, tax number: 33094557-1-42), represented by: Nagy Boldizsár ügyvezető. Contact: info@rosavallis.hu.

Our activity does not require us to appoint a data protection officer (GDPR Article 37), so we have not appointed one. For any question about how we handle data, write to the email address above.

2. Contact form — data, purpose and legal basis

When you fill out the contact form you provide the following data: your name, email address, optionally your phone number, and the content of your message. We collect no other data through the form.

We process your data solely to respond to your enquiry and to contact you. The legal basis is your consent (GDPR Article 6(1)(a)), given by ticking the checkbox on the form. You may withdraw your consent at any time, without giving a reason, via the email address above; withdrawal does not affect the lawfulness of processing carried out before it.

Providing the data is voluntary — you are under no statutory or contractual obligation to do so. Without your name, email address and message, however, we cannot answer your enquiry; the phone number is entirely optional.

We make no automated decisions and carry out no profiling based on the data you provide (GDPR Article 22).

3. Running the website — server logs

When you open the website, our server — like every web server — writes a technical log entry recording your IP address, the address of the page requested, the time of the request and the identifier sent by your browser (user agent). We need this to run the site securely and reliably, and to filter out abuse such as automated attacks and form spam.

The legal basis is our legitimate interest (GDPR Article 6(1)(f)) in operating and protecting our service. We do not link these logs to the data submitted through the form, and we do not use them to build visitor profiles. You may object to this processing at any time, as described in section 8.

4. Retention

We keep messages for up to 1 year after your enquiry is resolved, after which they are deleted. If the enquiry develops into a client relationship (e.g. an order), we'll provide separate information about the related data processing — including any statutory retention periods arising from invoicing and accounting obligations — when the contract is concluded. Technical web server logs are retained for at most 30 days and then deleted. Visitor statistics (section 7) are kept by the analytics service for 6 months and then deleted.

5. Processors and recipients

The contact form submits directly to our own server, hosted by Rackhost Zrt., and from there — through the Rackhost Zrt. mail server — your message arrives as an email in the mailbox above. We use no third-party form service, we do not sell your data, and we do not hand it over for advertising purposes.

Our processors:

• Rackhost Zrt. (hosting and email): processes the technical server logs required to serve the site and the messages stored in the mailbox, on our instructions only and under its own privacy policy.
• Umami Software, Inc. (San Francisco, USA; website analytics): processes the statistics described in section 7, stored in the European Union (Frankfurt), under a data processing agreement and on our instructions only.

Other recipients — only where, and only to the extent that, it becomes necessary in a given case:

• our accountant and invoicing provider, if the enquiry turns into a client relationship and billing;
• our legal counsel, if a legal claim connected to the enquiry has to be brought or defended;
• authorities and courts, where the law obliges us to disclose.

Your data is stored within the European Economic Area: hosting and email run on servers in Hungary, and visitor statistics are stored in Frankfurt, Germany. Umami Software, Inc., which provides the analytics, is a US-registered company; its data processing agreement binds it to EU data protection rules.

6. Data security

The website is only accessible over an encrypted (HTTPS/TLS) connection, and messages reach our mailbox over an encrypted (SMTP over SSL) connection. Data submitted through the contact form is not stored in a database of our own — the message arrives as an email in the mailbox above. Access to the website's source code and server is access-controlled and restricted to a small group. The form is protected against abuse (request rate limiting, filtering of automated submissions).

7. Cookies, local storage and analytics

The website does not use cookies and runs no marketing or advertising tracking. Our fonts are served from our own server.

For visitor statistics we use Umami, a cookie-free analytics service. When you open a page, and on certain clicks (such as a contact button, an email or phone link, opening a project page, switching language, or successfully sending the contact form), your browser sends Umami's server the address of the page, the referring page, your browser and operating system type, your device type and screen size, your browser language, and the country derived from your IP address. Umami does not store your IP address, sets no cookies, and does not track you across other websites. We only see aggregated statistics and cannot identify individual visitors.

The legal basis is our legitimate interest (Article 6(1)(f) GDPR): understanding how many people visit, where they come from, and which content is useful to them. You may object to this processing at any time as described in section 8, and you can also block the measurement with a content blocker in your browser.

We store one single thing on your device: if you switch to the light appearance, we save a setting named theme in your browser's local storage, so the site looks the way you chose on your next visit. That value never leaves your device, is never sent to our server, and cannot identify or track you. Because it is strictly necessary for a feature you explicitly asked for, we do not need consent to store it; you can remove it at any time by clearing your browser's stored site data.

If we introduce cookies or further analytics in the future, we will update this policy and, where required by law, ask for your prior consent.

8. Your rights

You may exercise the following rights via a request sent to the email address above:

• Access: ask whether we process your personal data and access that data.
• Rectification: ask us to correct or complete inaccurate data.
• Erasure: ask us to delete your data where there is no other legal basis for processing it.
• Restriction: ask us to restrict processing, e.g. while you contest the accuracy of the data.
• Portability: ask for the data you provided in a structured, machine-readable format.
• Withdrawal of consent: withdraw the consent you gave for the contact form at any time.
• Objection: object to processing based on legitimate interest — the server logs described in section 3.

We respond to your request within 1 month at the latest. Where the request is complex, that deadline may be extended by a further 2 months, which we will tell you about within 1 month of receiving the request. Information and action are free of charge.

9. Remedies

If you believe our processing violates the GDPR, you may lodge a complaint with the Hungarian data protection authority, or bring the matter before a court — either the court with jurisdiction over the Data Controller's registered seat, or, at your choice, the court with jurisdiction over your place of residence.

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH — Hungarian National Authority for Data Protection and Freedom of Information)
Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
Phone: +36 (1) 391-1400
Email: ugyfelszolgalat@naih.hu
Website: naih.hu

10. Changes to this policy

If the way we handle data changes, we update this policy and change the "Last updated" date above. For a material change — introducing a new processing purpose, for example — we will also point it out separately on the website.