Káldor Levente Viktor e.v. · levikaldor.hu/en/privacy/

Privacy policy

Effective from: 6 November 2026

In short

This policy explains which personal data I handle when you use levikaldor.hu, why, for how long, and what your rights are. In short: the website uses no cookies, analytics or trackers; the hosting provider keeps technical logs, and I only handle other data when you send a message or I receive an engagement.

1. Controller

• Name: Káldor Levente Viktor e.v. (sole proprietor, Hungarian egyéni vállalkozó)
• Registered seat: 2800 Tatabánya, Ifjúság utca 45. 9. em. 27. ajtó
• Registration number: 63004353
• Tax number: 92505933-1-31
• Email: hello@levikaldor.hu

I am not required to appoint a data protection officer. You can reach me about any privacy matter at the email address above.

2. What data I handle and why

Contact form

• Data:name, email address, chosen topic, message text, selected language, time of submission, and your current website address if you give one
• Purpose:answering the enquiry and keeping in touch about it
• Legal basis:the controller's legitimate interest in answering enquiries sent to him (GDPR Art. 6(1)(f)); where the enquiry aims at a contract, steps taken before entering into it (GDPR Art. 6(1)(b))
• Retention:12 months: a daily automated job deletes it from the database (it also runs when the admin area is opened), and the controller deletes the notification email from his mailbox after the same period; earlier if you ask for erasure. The email delivery provider (Resend) keeps sent-email data for at most 30 days, then deletes it automatically
• Processors:Supabase Pte. Ltd., Plus Five Five, Inc. (Resend), Google Ireland Limited (Gmail), Vercel Inc.

Project builder: quote request

• Data:name, email address, and if you give them, phone number and organisation name; the project data: the chosen project type, package and services, your answers to the questions, the description, goal and audience of the project, inspirations, the deadline, the optional budget band and the notes; the informative estimate calculated by the server and the version of the price list, the selected language, the time of submission
• Purpose:reviewing the quote request, preparing the quote and keeping in touch. Nothing reaches the controller while you fill it in: the data goes into the database and to the controller only when you send it with the "Send quote request" button (the draft kept while you fill it in is covered in the cookie and local storage notice)
• Legal basis:steps taken at your request before entering into a contract (GDPR Art. 6(1)(b))
• Retention:12 months: a daily automated job deletes it from the database, and the controller deletes the notification email from his mailbox after the same period; earlier if you ask for erasure. If the quote request leads to a contract, the data belonging to the contract is covered under "Performing engagements". The email delivery provider (Resend) keeps sent-email data for at most 30 days, then deletes it automatically
• Processors:Supabase Pte. Ltd., Plus Five Five, Inc. (Resend), Google Ireland Limited (Gmail), Vercel Inc.

Project builder: emailing the summary

• Data:the email address you enter and the content of the summary: the selected services, your answers to the multiple-choice questions and the informative estimate (text you type freely is not included)
• Purpose:sending you the summary you asked for at your own email address; the controller receives nothing from it
• Legal basis:providing the service you asked for (GDPR Art. 6(1)(b))
• Retention:the controller does not store it: the address and the content reach the server only while the email is being sent and are saved nowhere. The email delivery provider (Resend) keeps sent-email data for at most 30 days, then deletes it automatically
• Processors:Plus Five Five, Inc. (Resend), Vercel Inc.

Email to hello@levikaldor.hu

• Data:email address, name (if it appears in the email), the content and attachments of the email, time of sending
• Purpose:answering the enquiry and keeping in touch about it
• Legal basis:the controller's legitimate interest in answering enquiries sent to him (GDPR Art. 6(1)(f)); where the enquiry aims at a contract, steps taken before entering into it (GDPR Art. 6(1)(b))
• Retention:the controller deletes it from his mailbox after 12 months; earlier if you ask for erasure. If the correspondence leads to a contract, emails belonging to that contract are kept for the period required by law
• Processors:Cloudflare, Inc. (Email Routing), Google Ireland Limited (Gmail)

Performing engagements

• Data:the name, email address, phone number, company and position of the client or the client's contact person, correspondence about the engagement; the contract records kept in the contract manager: the client's identification and contact details, the terms of the contract, the generated contract documents and the signed (scanned) copies
• Purpose:making an offer, concluding and performing the contract, keeping in touch; keeping records of contracts, their documents and signed copies. The controller stores contract data and documents encrypted at application level, in a database hosted in the European Union (Frankfurt)
• Legal basis:concluding and performing the contract (GDPR Art. 6(1)(b)); for companies' contact persons, the controller's legitimate interest in keeping in touch (GDPR Art. 6(1)(f))
• Retention:for 8 years after the contract ends or is performed (counted from the later of the two dates). Even at the end of the retention period the contract manager does not delete anything by itself: the controller decides on deletion and carries it out only after the retention period has expired. Archived and rejected cases are kept: they do not expire and are not deleted. Cases without a contract end or completion date (ongoing or open-ended contracts) are also kept and do not expire automatically. Archiving or rejecting a case does not delete anything. As an exception, unfinished drafts (cases for which no final document was ever produced) may be deleted by the controller at any time, on his own decision, regardless of the retention period. The retention of invoices is covered under "Invoicing"
• Processors:Supabase Pte. Ltd., Google Ireland Limited (Gmail), Cloudflare, Inc. (Email Routing)

Invoicing

• Data:the client's name, address, tax number (if any), the details of the service and the fee
• Purpose:issuing and keeping invoices with the Billingo invoicing software; by law, invoice data is reported to the Hungarian tax authority (NAV, online invoicing)
• Legal basis:compliance with a legal obligation (GDPR Art. 6(1)(c); Sections 159 and 179 of the Hungarian VAT Act CXXVII of 2007 and Section 78 of the Tax Procedure Act CL of 2017)
• Retention:until the limitation period for assessing the tax expires, that is, for 5 years from the last day of the year in which the tax return was due (Section 78(3) and Section 202(1) of the Tax Procedure Act)
• Processors:Billingo Technologies Zrt.

Abuse prevention

• Data:IP address of the device sending the message, quote request or summary email
• Purpose:limiting bulk automated messages (spam): a few messages, quote requests or summary emails per hour from one IP address
• Legal basis:the controller's legitimate interest in preventing misuse of the service (GDPR Art. 6(1)(f))
• Retention:only in the server's memory, as a one-way (salted) hash, for about 1 hour; the controller does not store it in a database or log (the hosting provider's access logs are covered under 'Serving the website')
• Processors:Vercel Inc.

Serving the website

• Data:IP address, browser and device details (user agent), requested address, time of request
• Purpose:technically delivering the website, its security and troubleshooting
• Legal basis:the controller's legitimate interest in operating the website securely (GDPR Art. 6(1)(f))
• Retention:the hosting provider's runtime logs are deleted after 1 hour; the controller does not export, forward or analyse these logs
• Processors:Vercel Inc.

Do you have to provide the data?

No law or contract requires it. To send the form, your name, email address and message are needed, because without them I cannot reply. Instead of the form, you can also email me directly. For an engagement, the data needed for the contract is a requirement for concluding it, and invoicing data is required by law: without them I cannot make the contract or issue an invoice.

Where does the data come from?

I usually get the data from you. For an engagement, I may also receive a company contact person's details from the client company; even then I only handle what is needed to keep in touch (name, position, email address, phone number) (GDPR Art. 14).

Legitimate interest assessment

Contact and abuse prevention rely on legitimate interest. My assessment: answering an enquiry requires the name, email address and message, which you provide so that I can reply. For abuse prevention the IP address exists only in memory, as a one-way hash, for about one hour. I do not use the data for anything else, such as marketing or profiling, and I do not pass it on. Your interests and rights therefore do not override this narrow processing. You can object to it at any time (see section 6).

3. What I do not do

• No cookies, analytics, trackers, advertising or social media plugins (details: cookie notice).
• Every file of the website (fonts, images, scripts) loads from its own domain; no third-party server is contacted by your browser.
• No automated decision-making or profiling.
• I do not sell data or share it with third parties for marketing.

4. Processors

The following providers handle data on my behalf and on my instructions:

You can ask for a copy of the transfer safeguards (standard contractual clauses, data privacy framework) at hello@levikaldor.hu.

5. Security

The connection is encrypted (HTTPS). Only I read the content of the messages, in a password-protected admin area; technically, the processors listed in section 4 can also access the data, to the extent needed for their task. The notification email contains the submitted text in a safe form that cannot run as code. The application saves the data and documents of the contract manager to the database encrypted, and access is protected by two-step authentication.

6. Your rights

• Access: ask what data I hold about you and request a copy.
• Rectification: ask me to correct inaccurate data.
• Erasure: ask me to delete your data, also before the retention period ends.
• Restriction: ask me to only store the data for a period.
• Objection: object to processing based on legitimate interest.
• Portability: receive data processed for pre-contractual steps in a machine-readable format.

Send your request to hello@levikaldor.hu. I reply within one month at the latest; for complex requests the GDPR allows extending this by two further months, in which case I will let you know. Requests are free of charge.

7. Remedies

If you feel your rights have been infringed, please write to me first so we can sort it out. You also have the right to lodge a complaint with the supervisory authority:

• Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
• Address: 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.
• Phone: +36 1 391 1400; email: ugyfelszolgalat@naih.hu
• Website: naih.hu

You may also go to court; in Hungary you can bring the case before the regional court of your place of residence or stay. You may also complain to the supervisory authority of your own EU country.

8. Legislation

• Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR)
• Hungarian Act CXII of 2011 on informational self-determination and freedom of information
• Hungarian Act C of 2003 on electronic communications – rules on cookies
• Hungarian Act CXXVII of 2007 on value added tax and Act CL of 2017 on the rules of taxation – issuing and keeping invoices

9. Changes

If the processing changes, I update this policy and its effective date.

• 2026-11-06: New project builder page (/en/project-builder/): quote request data (name, email, the project and the choices, an informative estimate) is stored for 12 months, only after the "Send quote request" button; at the visitor's request the summary can be emailed to their own address, which the site does not store; the draft kept while filling in is held by the browser until the tab is closed (sessionStorage); abuse prevention now also covers quote requests and summary emails.
• 2026-11-04: The data of the contact form now also covers the chosen topic and, if you give it, your current website address.
• 2026-11-03: The "Performing engagements" entry now covers the contract records kept in the contract manager (client details, contract terms, contract documents and signed copies), application-level encryption and a more precise retention period (8 years; archived and rejected cases and cases without a closing date are kept and do not expire, unfinished drafts can be deleted regardless of the retention period); among the processors, Supabase now also stores the contract data; the registered seat is shown in its full registered form (with the door number).
• 2026-10-27: Corrected the authority keeping the register of sole proprietors (National Tax and Customs Administration) in the imprint and the terms; the cookie notice title now also mentions local storage; the accessibility statement is clearer about what the automated tests do and do not show; the Hungarian privacy policy now also mentions complaining to the supervisory authority of your own EU country, as the English one already did.
• 2026-10-25: Legal review: a new processor for invoicing (Billingo); the full registered address, the retention period and legal basis for invoices under the tax rules that apply to a sole proprietor, the source of the data, a copy of the transfer safeguards, clarifications in the terms (consumer confirmation, warranty, oral complaints, ongoing engagements) and the legal reference in the cookie notice.
• 2026-10-25: Terms and conditions for using the website and for engagements; new processing entries for client data (contract, invoicing).
• 2026-10-24: The controller now operates as a sole proprietor (business details in the imprint); new contact address: hello@levikaldor.hu, with a new processor forwarding its emails (Cloudflare Email Routing); exact retention periods for Resend and the hosting logs.
• 2026-10-14: Full revision: blog, comments, analytics, external fonts, bot check and booking widget removed; the website uses no cookies; new list of processors.