Data Protection & Privacy Policy

Controller (who is responsible for your data)

Privacy contact / person responsible internally

What personal data we collect

Depending on how you interact with us, we may process:

• Identity data: name, title, company/organisation (if provided)
• Contact data: email, phone number, postal address
• Communication data: message content and attachments you send us; call notes
• Contract and customer data: service requests, orders, agreements, customer account data (if applicable)
• Billing and transaction data: invoices, payment status, transaction history

  Important: we do not intend to store full payment card details on our systems where payments are handled by a payment service provider (if applicable).

• Technical and usage data: IP address, device and browser information, approximate location (derived from IP), website interaction, log files, and similar data
• Cookie and similar technology data: identifiers and preferences stored/collected via cookies or similar technologies (see Cookies section)

We do not intentionally collect special category data (e.g., health data, biometric data, political opinions). If you voluntarily provide such data in communications, we will handle it only where lawful and necessary.

Why we process personal data and our legal bases

We process personal data only where we have a lawful basis. Depending on the context, our legal bases are:

Recipients of personal data (who we share data with)

We may share personal data with:

• Service providers acting as processors (e.g., IT hosting, website maintenance, email/communications tools, CRM systems, accounting support, payment service providers)
• Professional advisers (e.g., accountants, auditors, legal counsel) where necessary and permitted
• Public authorities, courts, regulators, and law enforcement where required by law or necessary for legal claims

We require processors to act only on our instructions and to apply appropriate technical and organisational safeguards.

International transfers

If we use service providers located outside the EU/EEA (or whose support teams access data from outside the EU/EEA), we will ensure that transfers are protected by an appropriate transfer mechanism (e.g., an adequacy decision or Standard Contractual Clauses and supplementary measures where required). You can request information about the transfer mechanism we rely on by contacting us.

How long we keep personal data (retention)

We keep personal data only as long as necessary for the purposes described above, and then delete or anonymise it unless we must keep it longer for legal reasons.

Indicative retention periods:

• Enquiries (no contract formed): up to 12–24 months after last contact
• Contract/customer records: for the duration of the contract plus up to 10 years for limitation periods
• Invoices/accounting records: for the period required by applicable accounting/tax law (often multiple years; may be up to 10 years depending on obligation)
• Marketing subscriptions: until you unsubscribe/withdraw consent, or after 12 months of inactivity
• Website security logs: typically up to 6–12 months, unless needed for incident investigation

Your data protection rights

Subject to GDPR conditions and exceptions, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data (“right to be forgotten”) in certain cases
• Restrict processing in certain cases
• Data portability (where applicable)
• Object to processing based on legitimate interests
• Object at any time to direct marketing
• Withdraw consent at any time (where processing is based on consent), without affecting lawfulness before withdrawal
• Lodge a complaint with a supervisory authority

How to exercise your rights

To exercise your rights, contact us at info@addeyenterprises.com. We may request information necessary to confirm your identity. We respond without undue delay and generally within one month (extendable in certain cases under GDPR, with notice).

Supervisory authority (Hungary)

If you believe our processing infringes the GDPR, you can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or with the supervisory authority where you live/work in the EU.

Automated decision-making and profiling

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you using the data described in this notice. If this changes, we will update this notice and provide the required information.

Security (how we protect personal data)

We apply appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, loss, or disclosure. Measures may include access controls, authentication, confidentiality commitments, backups, and security monitoring, appropriate to the risk.

Cookies and similar technologies

We use cookies and similar technologies:

• Strictly necessary cookies: required for website functionality and security.
• Optional cookies (e.g., analytics/marketing): used only where you have provided valid consent via our cookie banner/settings.

You can manage your cookie preferences at any time via your browser settings.

Changes to this Privacy Notice

We may update this notice from time to time. The “Last updated” date at the top of this page shows when it was last changed. If we make material changes, we will provide an appropriate notice on our website or via other communication channels where appropriate.