Privacy and data processing notice

Effective from: 19 September 2026

1. The Data Controller

• Name: Sztányi András E.V.
• Registered office: 2360 Gyál
• Tax number: 91861137-1-33
• Phone: +36 70 947 3531
• Email: [email protected]
• Website: webvillam.hu

The Data Controller processes personal data under the European Union's General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Infotv.). We process only what is strictly necessary to provide our services and contact businesses.

2. What data do we process and why?

A) Business development (contact) data — contacting businesses

• Source of the data: publicly available business sources: the business's own website, public company and sole trader registers, Google Maps / Business Profile. We therefore do not collect this data directly from you (GDPR Article 14).
• Data processed: the business's name, public email address, phone number, address, website address, and technical metrics that can be determined publicly from the website (e.g. loading speed).
• Legal basis: the Data Controller's legitimate interest (GDPR Article 6(1)(f)): direct marketing (B2B). We primarily process general, business-related contact details (e.g. info@cég.hu).
• Purpose: sending the business a relevant, personalised website proposal.
• Retention: until the outreach process is closed, or until an objection / unsubscribe request; we then delete the data or make it inaccessible.

B) Demonstration (demo) websites

As part of outreach, we sometimes create a temporary demo website based on the business's publicly available data, illustrating what a modern website could look like. These pages are blocked from search engine indexing (noindex), are intended solely for presentation to the recipient of the outreach, and do not replace the business's official website.

C) Contact forms and incoming enquiries

• Data processed: name, email address, phone number (if provided) and message content. The Google Ads pilot form also adds the submitted website, service and operating area, the answer about budget, a randomly generated enquiry identifier and the campaign marker in the link to the enquiry.
• Source of the visit: on the webvillam.hu forms, we send along with your enquiry where you arrived from: the addresses of the landing page and the submitting page, the domain name of the referring website, any campaign tags (UTM), and whether the link contained an advertising click identifier (without its value). Your browser tab's session storage (sessionStorage) keeps this only until the tab is closed, and we transmit it solely when the form is submitted, to determine the source of the enquiry.
• Legal basis: your consent or steps prior to entering into a contract (GDPR Article 6(1)(a) and (b)).
• Purpose: responding to your enquiry and providing a quote.

D) Client and billing data

• Data processed: for contracted clients: billing name, address, tax number and business data necessary for the service.
• Legal basis: performance of a contract (GDPR Article 6(1)(b)) and a legal obligation (accounting retention).
• Retention: 8 years under Hungarian Act C of 2000 on Accounting.

E) Technical logging and view measurement

• Data processed and purpose: technical logging of demo website views and clicks on links in outreach emails (time, page), and basic aggregate traffic measurement on webvillam.hu. Section 4 sets out the exact data used for basic measurement and the details of consent-based enhanced measurement. We do not sell data.
• Legal basis: the Data Controller's legitimate interest (GDPR Article 6(1)(f)): measuring whether outreach was relevant and, in aggregate, which types of website content are used. Consent-based enhanced measurement relies on GDPR Article 6(1)(a).

3. Data processors (who do we share data with?)

For the US-based data processor, the EU Standard Contractual Clauses (SCCs) ensure an adequate level of data protection.

3.1 The website AI chat assistant

The website uses an AI (artificial intelligence) chat assistant which states at the start of the conversation that you are talking to AI, not a person. An AI provider processes the conversation text to generate replies; this processing may take place outside the EU. Please do not enter personal data in chat messages. If you request contact, we ask for your contact details (name, email, phone number) in a separate, structured form. These details are not sent to the AI provider and are used only to contact you. We retain conversations for up to 90 days. Loading the chat alone does not create an identifier. When you send the first chat message or initiate contact through the chat, a random technical session identifier is created in the browser tab's session storage (sessionStorage); it is deleted when the tab is closed.

4. Cookies and web analytics

We may use technical browser storage that is strictly necessary for webvillam.hu to function (for example, the chat session identifier that lasts for the browser tab's lifetime). We do not request separate consent for this because it is necessary to provide the service you explicitly use; we do not use it for marketing.

With PostHog EU Cloud, we use two-tier measurement on this website. PostHog's JavaScript loads when the page opens. Without consent, or when consent is refused, only the highly restricted basic measurement described below operates; enhanced measurement is enabled only after your explicit consent.

Basic measurement — without cookies or browser-stored analytics identifiers

Before a decision, when consent is refused, and after consent to enhanced measurement is withdrawn, we send a minimal page-view signal when the page is opened. This includes a single-use technical event identifier and timestamp, the page's predefined category or technical page identifier without query parameters or URL fragments, the operating environment, the technical classification of traffic and the consent status.

• We do not send the full URL, query parameters, URL fragment, referring page, UTM parameters or other campaign parameters.
• We do not record clicks, form or chat data, contact or other conversion events, performance or error reports, mouse movements, heatmaps, behavioural events or session recordings.
• Basic measurement does not create analytics cookies, localStorage or sessionStorage identifiers, browser-stored device or session identifiers, or a person profile. Separately, we retain your “basic measurement only” choice in the browser's local storage so that we do not have to ask again on every visit.

During cookieless, stateless ingestion, the browser's User-Agent data and the network connection's IP address are technically involved in generating a server-side hash that changes daily. Our own intermediary server does not forward the visitor's actual client IP address to PostHog, so PostHog processes the intermediary server's IP address. After generating the hash, PostHog does not retain the raw User-Agent or IP address. As multiple visitors appear under the same intermediary IP address and may also use the same User-Agent, this signal cannot reliably determine unique visitor or session counts; we use the data only as aggregate page-view statistics.

The strictly limited client-side payload of the basic measurement signal does not send device or session identifiers. However, PostHog's stateless server-side processing may use the daily hash described above to add technical $device_id and $session_id fields to the stored event. These are not browser-stored identifiers, and because of the intermediary server, we do not use them to reliably measure unique visitors or sessions.

The legal basis for basic measurement is the Data Controller's legitimate interest (GDPR Article 6(1)(f)): understanding, in aggregate and with minimal data, whether the website works and which types of content are visited. Our balancing of interests considers the narrow purpose of processing, the absence of persistent identifiers and behavioural data, and the technical limitations above. Even though this operates without cookies, we do not claim that the processing is legally anonymous or automatically exempt from data protection rules.

Enhanced measurement — only with consent

After your explicit consent, we also enable measurement of traffic, referral sources and campaign markers, page-loading performance, technical browser errors, and contact steps via phone, email, forms and chat. Enhanced measurement may also create masked session recordings of how you move the mouse and what you click on the page. Microsoft Clarity provides session recordings and heatmaps; PostHog provides event and conversion tracking.

Enhanced measurement retains random technical session and visitor identifiers containing no direct personal identifiers, along with sanitised first-visit attribution data, in the browser tab's sessionStorage to maintain continuity within that tab's session. Even in this mode, we do not store the PostHog analytics identifier in cookies or localStorage. We do not create PostHog person profiles. Clarity, by contrast, may use analytics cookies after consent (for example, _clck and _clsk); we do not grant Microsoft permission for storage for advertising purposes.

We apply data minimisation: query parameters and URL fragments are removed from technical URL and referrer fields before transmission; for external referrers, only the hostname may remain. For campaign measurement, UTM source, medium, campaign, content and term may be retained as separate short labels; any email address, phone number or authentication token in them is masked. Even in this mode, we do not forward the actual client IP address to PostHog, we disable IP-based geographical enrichment, and we mask the text and HTML attributes of automatically captured clicks.

We mask contact form fields. The entire AI chat panel, including entered and displayed messages, business names, website addresses and contact fields, is excluded from analytics autocapture and session recordings. When contact is successfully initiated, we measure the fact that the step occurred, the page path and type, and a non-personal technical classification (e.g. form identifier, callback or demo request, chat tenant); we do not measure the submitted name, email address, phone number or message.

We retain the consent decision in the browser's local storage for up to 180 days. You may change or withdraw your consent at any time using the “Privacy settings” button at the bottom of the page. After refusal or withdrawal, we stop enhanced measurement and session recordings, delete the analytics session and visitor identifiers stored in the browser, and continue only with the basic measurement described above. We generally retain session recordings in Clarity for 30 days; recordings selected by the provider or saved as favourites are retained for up to 9 months. We review the necessity of analytics events at least every 12 months and delete data that is no longer needed for measurement purposes.

Clarity measurement on demo pages

On test.webvillam.hu the demos use a separate consent interface. We do not load Clarity's code before “Allow” is selected. If consent is refused, all demo functions remain available. The choice is valid for 180 days and can be changed using the “Privacy” button. Existing server logging of the demo's simple page-view signals and certain button actions operates separately.

Clarity may process the structure of the displayed page, clicks, scrolling, mouse movements, browser and device characteristics, the page address and network data from requests. Fields, summaries and chat content containing personal data are masked; we do not send form values, messages or contact details in separate events. We distinguish demos by the page identifier; this does not verify the visitor's identity. The legal basis for processing is consent (GDPR Article 6(1)(a)). Further information: Microsoft Privacy Statement.

4.1 Measurement on the Google Ads pilot landing page

On the Google Ads pilot landing page (in Hungarian) I load Google's advertising measurement code only after the separate measurement consent shown there has been given (Basic Consent Mode). Previous web analytics consent for the rest of the website does not replace this. PostHog measurement and session recordings do not operate on this landing page.

• Purpose and legal basis: linking an ad click to a successful enquiry and evaluating campaign performance, based on your consent (GDPR Article 6(1)(a)).
• Data: ad click identifier (e.g. gclid, gbraid or wbraid), page address, technical browser and network data, and the fact and random identifier of a successful submission. I do not assign fictitious revenue to an application. I do not send names, email addresses, phone numbers or form text to Google's measurement service; enhanced conversions and personalised advertising are not enabled.
• Data stored in the browser: the wv_ads_pilot_consent local setting retains the decision for up to 180 days. Refusal may also be stored for the same period in the wv_ads_pilot_denied preference cookie, so that a storage error does not restore a previous permission. Google's _gcl_* advertising measurement cookies have a requested lifetime of up to 90 days; the campaign's post-click conversion window is 30 days.
• Refusal and withdrawal: when consent is refused, Google's code does not load and the application form remains fully usable. You may change your decision at any time using the “Measurement settings” button in the landing page footer. On withdrawal, Google code already loaded may receive a denied-consent signal; I send no further application conversions and delete accessible first-party advertising cookies. Withdrawal does not affect the lawfulness of previous processing.

From enquiry to order: where separate measurement consent is given, I retain the click identifier and consent version, linked to the enquiry's random identifier, for up to 90 days. The wv_ads_pilot_attribution browser storage helps retain the source until a later return visit, subject to the same time limit. The marker in the link alone does not prove that Google attributed the order to the ad. Becoming a qualified lead, placing an order and a payment confirmed in the invoicing system may be sent to Google as separate events, including the payment amount where necessary. I do not send the form's personal fields in this case either.

For internal reconciliation, the identifier may be associated with links to correspondence and the quote, a hash of the email address and the linked invoice identifier. These support the quotation and client management process; the hash is not anonymous data. I delete the measurement-related click link on withdrawal; contractual and billing data remain subject to their own retention rules. The wv_ads_pilot_revocations setting retains only the deletion key needed to verify server-side withdrawal; it may retry deletion after a network error. If browser storage is unavailable or you are using another device, withdrawal can be requested at [email protected] as well.

About Google's data processing, retention and international data transfers: Google Privacy Policy and Partner sites that use Google services.

5. Your rights

Under the GDPR, you have the right to:

• Access: request information about the personal data processed about you.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of your data.
• Data portability: request your data in a machine-readable format.
• Objection: object to processing based on legitimate interest, including basic aggregate website measurement. For direct marketing (outreach), this right is unconditional, and we will stop the processing immediately; for other processing based on legitimate interest, we assess the objection under GDPR Article 21.
• Withdrawal of consent: withdrawal does not affect the lawfulness of previous processing.

You may submit your requests to [email protected] by email. The Data Controller will fulfil the request within 30 days at the latest.

6. Remedies

If you believe that the processing of your personal data is unlawful, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):

• Registered office: 1055 Budapest, Falk Miksa utca 9-11.
• Postal address: 1363 Budapest, Pf. 9.
• Email: [email protected]
• Website: naih.hu

7. Changes to this notice

The Data Controller reserves the right to amend this notice. The amended version takes effect upon publication on the website.