Privacy notice
Effective: 26 September 2026
Draft — legal review and completion of missing details required before going live.
1. Controller
- Controller: ARworks [exact company name and legal form to be completed]
- Registered office: 1012 Budapest, Várfok utca 3–5., Hungary
- Mailing address and office: 1053 Budapest, Királyi Pál utca 18., Hungary
- Tax number: 13963763-2-41 · Company registration number: [to be completed]
- E-mail: szbudahazy@arworks.com · Phone: +36 30 99 00 336
- Privacy contact: Szabolcs Budaházy, founder & CEO
2. What data we process, why and on what legal basis
| Processing | Data | Purpose and legal basis | Retention |
|---|---|---|---|
| Contact form | name, business e-mail, company, role, message, language, campaign source (UTM) | Answering your request, preparing an idea pack — consent (GDPR Art. 6(1)(a)) | Until consent is withdrawn, at most 24 months after the last update |
| Business outreach (B2B) | name, role, company, business e-mail, public professional profile (e.g. LinkedIn) and their sources | Sending a tailored business proposal related to the company’s existing sports sponsorship — legitimate interest (GDPR Art. 6(1)(f)); the balancing test is available on request | 12 months without activity, then anonymised; immediately upon objection |
| Suppression list | e-mail address or domain, fact of objection | Respecting the objection so we never contact you again — legal obligation and legitimate interest | As long as the objection stands |
| Presentation view statistics | random per-page-load visit ID, slides viewed, duration, device type — no cookies, no IP storage | Measuring whether presentations are understandable — legitimate interest | 24 months |
| Web analytics (if enabled) | Umami: aggregated, cookie-less visit data | Improving the site — legitimate interest | Aggregated only |
| Server logs | IP address, time, requested page, browser type | Security, debugging, abuse prevention — legitimate interest | At most 30 days |
| Admin users | name, e-mail, password (hashed only), sign-ins, action log | Operating the system securely — legitimate interest | Until the account is closed; sessions are deleted on expiry |
3. Where business contact data comes from
We collect data about the professionals we contact from public sources: company websites, press releases, trade media and public professional profiles. We only process business, role-related data — never private-life data.
The first outreach e-mail informs the recipient about the processing (GDPR Art. 14). They can object simply by replying — the address is then added to our suppression list and no further e-mails are sent.
4. Processors and transfers
- Hosting and database: [to be completed — planned: Hetzner Online GmbH, Germany]
- E-mail (sending outreach messages): [to be completed — provider of the sending mailbox]
- AI providers supporting research, copywriting and image analysis, depending on the task: Anthropic (Claude), OpenAI, Google (Gemini), Perplexity, DeepSeek. They only receive the data needed for the task; no personal data is sent for image analysis (logo recognition).
- Transfers outside the EEA rely on European Commission adequacy decisions (e.g. the EU–US Data Privacy Framework) or standard contractual clauses (SCCs).
5. Your rights
- Access: ask what data we hold about you.
- Rectification and erasure: ask us to correct or delete your data.
- Objection: you may object to processing for direct marketing at any time without giving reasons — we will not contact you again.
- Restriction and portability under GDPR Articles 18 and 20.
- You may withdraw consent at any time without affecting prior processing.
- Send requests to szbudahazy@arworks.com; we reply within one month.
6. Remedies
You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; www.naih.hu; ugyfelszolgalat@naih.hu) or go to court. Please write to us first — we aim to resolve issues quickly.
7. Security
Encrypted connections (HTTPS), role-based access, passwords and access codes stored only as hashes, action logging, regular backups. Outreach e-mails are only sent after human approval.
8. Changes
We update this notice when our processing changes; the current version is always available on this page.