Bella Kristóf
hu

In force from: 28 September 2026

Privacy policy

This notice explains which personal data I handle on this website, in inquiries and in business outreach, why and on what legal basis, for how long, and what your rights are. Processing follows the EU General Data Protection Regulation (GDPR) and Hungarian Act CXII of 2011 (Infotv.). The Hungarian version is authoritative.

Data controller

I am not required to appoint a data protection officer. For privacy questions, contact me at the email address above.

What I process and why

Contact form messages

  • Data: name, email address, company name and website (if given), the message.
  • Purpose: answering your inquiry and, if requested, preparing a quote.
  • Legal basis: steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)); if no cooperation follows, keeping a record of the inquiry based on my legitimate interest (Art. 6(1)(f)).
  • Retention: 1 year after the last contact; for clients, as described under client data.

Free website review requests

  • Data: name, website address, email address, phone number (if given).
  • Purpose: preparing and sending the review, clarifying questions.
  • Legal basis: steps taken at your request (Art. 6(1)(b)).
  • Retention: 1 year after the last contact.

Abuse prevention on the forms

  • Data: a cryptographic hash of the IP address (the full IP address is not stored) and the browser identifier (user agent).
  • Purpose: filtering automated spam and preventing overload.
  • Legal basis: my legitimate interest in operating the website and forms securely (Art. 6(1)(f)).
  • Retention: deleted together with the inquiry.

Email and phone communication

  • Data: name, email address, phone number, the substance of emails and calls.
  • Purpose: discussing quotes, projects and support.
  • Legal basis: preparing and performing a contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)).
  • Retention: as for client data or inquiries.

Client data

  • Data: names and contact details of the client and its contacts, billing details, project documents.
  • Purpose: performing the contract, invoicing, enforcing legal claims.
  • Legal basis: performance of a contract (Art. 6(1)(b)); keeping accounting records is a legal obligation (Art. 6(1)(c)).
  • Retention: 5 years after the contract ends (the civil-law limitation period); accounting records for 8 years under Section 169 of Hungarian Act C of 2000 on accounting.

Prospective business partners (companies)

I offer website, back-office and automation services to businesses. For this I collect data from publicly available sources (the company website, Google Maps, the company register, professional directories, LinkedIn).

  • Data: company name, address, website, tax and registration numbers; the business contact's name, role, business email and phone; the source is recorded for every item.
  • Purpose: approaching the business with a specific, tailored offer and keeping a record of the contact.
  • Legal basis: my legitimate interest in offering my business services (Art. 6(1)(f)). The balancing test is available on request.
  • Information: at the first contact I tell you where your data comes from (Art. 14).
  • Objection: if you tell me you do not want to be contacted, your data is marked "do not contact" and I will not contact you again; on request I delete it.
  • Retention: until you object, but at most 2 years after the last contact if no cooperation follows.

Mockups shared by a private link

If I make a website mockup for your business, I share it on a private link sent only to you (demo.bellakristof.hu). The mockup is not public, search engines do not index it, and I revoke the link whenever you ask.

  • Data: only how many times and when the mockup's pages were opened (first and last view). No IP address, browser data or cookies are recorded.
  • Purpose: knowing when it makes sense to follow up about the mockup.
  • Legal basis: my legitimate interest (Art. 6(1)(f)).
  • Retention: until 30 days after the link expires or is revoked (until then it can be turned back on); after that the mockup files and the view data are deleted automatically.

Reviews of company websites (e.g. mobile-friendliness, speed) are about the business, not about you; they have no legal effect on you, and every decision is made by me (no automated decision-making).

Cookies

The website only uses cookies that are strictly necessary for it to work; these do not require consent. No analytics, marketing or third-party tracking cookies are used.

  • bella-kristof-session – session cookie for secure form handling; expires at the end of the session, at the latest after 2 hours.
  • XSRF-TOKEN – protection against cross-site request forgery; expires after 2 hours.

Fonts and all other files are served from my own server, so opening the website sends no data to third parties.

Who has access (processors)

Apart from me, only the following providers can access the data, and only as far as needed to provide their service:

  • Hosting provider: UpCloud Oy, Aleksanterinkatu 15 B, 7th floor, 00100 Helsinki, Finland – hosting the website and the database.

  • Email provider: Google Ireland Limited (Google Workspace), Gordon House, Barrow Street, Dublin 4, Ireland – the hello@bellakristof.hu mailbox, sending and storing email. Data may also be transferred to the United States; Google LLC participates in the EU–US Data Privacy Framework.

  • Storage for mockups: UpCloud Oy (Managed Object Storage), Aleksanterinkatu 15 B, 7th floor, 00100 Helsinki, Finland – storing the files of shared mockups.

  • Anthropic PBC (San Francisco, USA) – the Claude AI assistant, which I use to research public business information and to prepare texts. Transfers outside the European Economic Area rely on the safeguards in the provider's data processing terms. The AI assistant makes no decisions; I review everything it prepares.

I do not sell your data or share it for marketing purposes.

Security

Data is received over encrypted (HTTPS) connections, and only I can access the admin interface with a password-protected account. I make regular backups and only store the data needed for the purposes above.

Your rights

  • Access: ask what data I hold about you (GDPR Art. 15).
  • Rectification: have inaccurate data corrected (Art. 16).
  • Erasure: have your data deleted when there is no legal basis to keep it (Art. 17).
  • Restriction: have processing restricted (Art. 18).
  • Portability: receive the data you provided in a machine-readable format (Art. 20).
  • Objection: object at any time to processing based on legitimate interest; after an objection to direct marketing your data is no longer used for that purpose (Art. 21).

Send your request to hello@bellakristof.hu; I reply within one month at the latest.

Remedies

If you think your data is not handled properly, please contact me first so we can sort it out. You can also lodge a complaint with the supervisory authority:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) – Hungarian National Authority for Data Protection and Freedom of Information Address: 1055 Budapest, Falk Miksa utca 9–11, Hungary Postal address: 1363 Budapest, Pf. 9 Phone: +36 1 391 1400 Email: ugyfelszolgalat@naih.hu Website: naih.hu

You may also go to court; proceedings can be brought before the regional court of your place of residence.

Changes

I update this notice when my services or the law change; the version in force is always on this page.