1. The data controller
Dr. Andrea Kovács, sole trader
Registered seat: 1139 Budapest, Gömb utca 17–21., Hungary
E-mail: andrea@kapcsolatkovacs.hu
Phone: +36 20 416 9846
2. The data processed, the legal basis and the purpose
a) Contact data (last name, first name, e-mail address, phone number)
During the period of getting in touch, the legal basis for processing is your consent (Article 6(1)(a) GDPR). By providing your data on the website you give this consent. After the mediation begins, the legal basis for processing is the performance of the contract between us (Article 6(1)(b) GDPR). Its purpose is to enable me to contact you and then to stay in contact during the process.
b) Invoicing (name, address)
The legal basis for processing the data needed for the invoice issued for the service fee is compliance with a legal obligation (Article 6(1)(c) GDPR). Even as a VAT-exempt sole trader, I am obliged to issue invoices and to retain accounting documents (under Act C of 2000 on Accounting).
3. Duration of data processing
Contact data: I store it for 2 months from the time it is provided. If no mediation begins during this time, I delete it without delay. You may withdraw your consent at any time. In that case I delete your data without delay, but this also means that the mediation cannot begin.
Invoicing data: under Section 169(2) of the Accounting Act, I store it for 8 years following the given year, then delete it. This obligation applies even if consent is withdrawn.
Data processed during the procedure: if mediation takes place, I process the related data for as long as necessary to carry out the process, then delete it – except for invoicing data that must be retained by law.
4. Data security
I provide the service as a sole trader, working alone. Only I have access to the personal data. I store the data on password-protected devices (laptop, phone) and handle incoming messages by e-mail. I take every reasonably expectable technical and organisational measure to keep the data secure and protected from unauthorised access.
5. Who has access to the data, data transfers, data processors
Only the data controller (Dr. Andrea Kovács) has access to the personal data. The data are stored and processed on servers located in the European Union. Some of the data processors listed below are companies established in the United States – any transfer of data to them takes place on the basis of the safeguards required by the GDPR (standard contractual clauses adopted by the European Commission, or the EU–US Data Privacy Framework).
To provide the service, I use the following data processors:
- Hosting provider: Fly.io, Inc. (USA) – serving the website from a data centre located in the European Union (Frankfurt).
- E-mail delivery: Resend, Inc. (USA) – delivering the messages sent via the contact form, through a data centre in the European Union.
- Invoicing: KBOSS.hu Kft. (Számlázz.hu) – issuing invoices.
6. Your rights
In relation to the data processing, you have the following rights:
- Access (Article 15 GDPR): you may request information on whether I process your personal data, and if so, how (for what purpose, for how long, who has access), and you may request a copy of it.
- Rectification (Article 16 GDPR): you may request the correction of inaccurate data and the completion of incomplete data.
- Erasure (Article 17 GDPR): you may request the deletion of your data. However, data that I am required to retain by law cannot be deleted – namely invoicing data for 8 years under Section 169(2) of Act C of 2000 on Accounting.
- Restriction of processing (Article 18 GDPR): you may request that I
restrict the processing of your data for a period. In that case I continue to store the
data but do not use it beyond mere storage – afterwards I may process it only with your
consent, for the establishment, exercise or defence of legal claims, to protect the rights
of another person, or for reasons of important public interest. Under the law you may
request this in the following cases:
- if you contest the accuracy of your data – for the period during which I verify it,
- if the processing is unlawful but you request restriction instead of erasure,
- if I no longer need the data, but you need it for the establishment, exercise or defence of legal claims,
- if you have objected to the processing.
- Objection (Article 21 GDPR): on grounds relating to your particular situation, you may object to the processing of your data. In that case I may only continue the processing if there are compelling legitimate grounds or it is required by law.
- Data portability (Article 20 GDPR): you may request that the data you provided based on your consent be given to you in a structured, machine-readable format, or – where technically feasible – transmitted directly to another controller.
- Withdrawal of consent: you may withdraw your previously given consent at any time. The withdrawal takes effect only for the future – processing carried out until then, based on your consent, remains lawful, and the withdrawal does not retroactively make it unlawful.
If you exercise the above rights (for example, request information or erasure) at the contact details given in section 1, I will respond to your request within 1 month at the latest. If the request is complex, this deadline may be extended by a further 2 months at most – I will inform you of such an extension within the first month. The response is free of charge in every case.
7. Remedies
You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) (Article 77 GDPR):
Address: 1055 Budapest, Falk Miksa utca 9–11.
Postal address: 1363 Budapest, Pf. 9.
Phone: +36 1 391 1400
E-mail: ugyfelszolgalat@naih.hu
Web: naih.hu
If your rights are infringed, you may also turn to a court (Article 79 GDPR).
8. Cookies and external services
The website does not use cookies. Visitor statistics are measured by the Cloudflare Web Analytics service (Cloudflare, Inc.), which produces aggregated, anonymous statistics only, without cookies and without individually identifying visitors. The website’s fonts are provided by the Google Fonts service, which may process the visitor’s IP address when the fonts are loaded.
Effective: July 2026