Privacy Notice

1.1. The controller

The controller of the processing operations described in the Privacy Notice is the Provider.

The Provider's details:

• (a) company name: TOPiN-HUB Korlátolt Felelősségű Társaság;
• (b) registered office and postal address: 2161 Csomád, József Attila utca 1., Hungary;
• (c) company registration number: 13-09-223835; registry court: Court of Registration of the Budapest Environs Regional Court (Budapest Környéki Törvényszék Cégbírósága);
• (d) tax number: 32134234-2-13;
• (e) EU VAT number: HU32134234;
• (f) email address: [email protected];
• (g) telephone number: +36 20 479 0790.

With regard to the processing operations described in Chapter 5, the Provider is a controller within the meaning of point 7 of Article 4 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the “GDPR”).

1.2. Data protection contact

The Provider receives the Data Subject's data protection questions, requests and complaints at the email address [email protected] and by post at its registered office. The Provider has not designated a data protection officer, as the conditions laid down in Article 37(1) GDPR are not met in its case.

1.3. Scope of the Privacy Notice

The Privacy Notice covers the Website, the Application, the emails sent by the Provider, the Quick Scan and the One-off Service ordered without an Account. It does not cover the processing carried out for their own purposes by Third-party Services (in particular Meta and LinkedIn) or by the recipients acting as independent controllers identified in Section 3.3 (such as Stripe and Google); their own privacy notices apply to that processing. Where the Provider acts as a processor on behalf of the Customer, the controller is the Customer; Chapter 6 provides information on this.

The Privacy Notice has been prepared on the basis of Articles 13 and 14 GDPR and Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (the “Infotv.”). The conditions for using the Service are set out in the Provider's General Terms and Conditions (the “Terms”). The Privacy Notice does not form part of the Contract, and acceptance of the Terms does not constitute consent to any processing.

3.1. The Provider as controller

The Provider is the controller of all the processing described in Chapter 5: the management of Accounts, Organisations and Subscriptions, payment and invoicing, notifications and advertising emails, the Website's forms, the Quick Scan and the One-off Service ordered without an Account, logging, customer support and compliance with legal obligations. In this respect, the Provider determines the purposes and means of the processing and is responsible for its lawfulness.

3.2. The Provider as processor

With regard to the personal data contained in Customer Content and Generated Content, the controller is the Customer, and the Provider is a processor acting on behalf of and on the instructions of the Customer. Chapter 6 provides information on this; the terms of the processing are set out in Annex 1 to the Terms (Data Processing Terms).

3.3. Recipients acting as independent controllers

The following recipients also process the data they receive for their own purposes, as controllers in their own right; their own privacy notices apply to that processing:

• (a) Stripe, when processing payments, for the purposes of fraud prevention and of complying with the legal obligations applicable to it (in particular the prevention of money laundering and customer identification); its privacy notice: https://stripe.com/privacy;
• (b) Google, when a User logs in with a Google account; its privacy notice: https://policies.google.com/privacy;
• (c) Meta (Facebook, Instagram) and LinkedIn, for the content that the Provider publishes on the Connected Account on the Customer's instructions;
• (d) Google, Meta and LinkedIn, for the data of the advertising tracking technologies used on the Website, once the data have reached them (Section 9.6).

The details of the recipients (name, registered office, role, country) are set out in Section 10.1.

5.1. Registration, Account management and login

• Purpose: creating the Account, confirming the email address, managing login and the session, resetting a forgotten password, and maintaining the Account.
• Data subjects: Users.
• Data processed: name; email address; the password in irreversible (hashed) form; the interface language; the status of the Account; the time of registration and of the confirmation of the email address; the password reset code, valid for 60 minutes; session data (IP address, identifying data of the browser and the device, time of last activity).
• Legal basis: if the User is the Customer, Article 6(1)(b) GDPR (performance of the Contract). If the User acts on behalf of a Business or another organisation, or as a Team Member, Article 6(1)(f) GDPR: the legitimate interest of the Customer and of the Provider in enabling the persons designated by the Customer to use the Service securely. The legitimate interest assessment is available at the Data Subject's request.
• Retention period: until the Account is deleted; the Provider deletes a registration created with an unconfirmed email address 30 days after registration; on deletion, the Provider immediately anonymises the name and the email address and deletes the sessions and the password reset codes (Section 12.4). A session expires 365 days after the last activity (not when the browser is closed), and its data are deleted during the system's regular clean-up. If the Data Subject does not complete the registration by confirming the email address, the Provider deletes the data because the purpose of the registration has failed.
• Recipients: MailerSend (delivery of the confirmation and password reset emails).
• Source: the Data Subject; for an Account created on behalf of a Team Member, the Owner or the Admin (Section 5.4); for registration with a Google account, Google (Section 5.2).
• Whether providing the data is mandatory: providing the name, the email address and – for registration with an email address – the password is a condition of registration; without them no Account can be created and the Service cannot be used.

5.2. Login with a Google account

• Purpose: registration and login with the User's Google account instead of an email address and password.
• Data subjects: Users logging in with a Google account.
• Data processed: the unique Google identifier, email address, name and profile picture link provided by Google. The Provider does not store Google's access token. If an Account already exists with the email address verified by Google, the Provider links the Google account to that Account; otherwise it creates an Account with a confirmed email address and without a password. The Application also identifies a User logging in with a Google account by means of a cookie providing persistent login (Section 9.3).
• Legal basis: as in Section 5.1, Article 6(1)(b) or (f) GDPR. The legitimate interest assessment is available at the Data Subject's request.
• Retention period: until the Account is deleted; when the Account is deleted, the Provider also deletes the Google identifier, the email address and the profile picture link.
• Recipients: Google, which learns of the login as a controller in its own right.
• Source: Google, at the Data Subject's request and on the basis of the permission given in their Google account.
• Whether providing the data is mandatory: no; registration is also possible with an email address and password.

5.3. Provision of the Service, records of the Organisation and of usage

• Purpose: providing the Service, including managing the Organisation and the Brands, keeping records of the Plan and the Subscription, measuring Credit usage and enforcing the Plan's limits. This also includes enforcing permissions according to Role, recording the cost of AI operations, managing the User's settings and recording who created each piece of content.
• Data subjects: Users and – if a natural person – the Customer.
• Data processed: the name of the Organisation and of the Brand (which may also contain the name of a natural person); membership and Role; the Plan; data on Credit usage; the metadata of AI operations (the task, the model, the units used, the cost, the time, the identifier of the User requesting the operation and any error message – without the text of the request and of the response); the metadata of keyword queries; notification settings and the notifications displayed in the Application; the identifier of the creator of content, comments and Source Materials.
• Legal basis: as in Section 5.1, Article 6(1)(b) or (f) GDPR. The legitimate interest assessment is available at the Data Subject's request.
• Retention period: for the term of the Contract, thereafter in accordance with Section 12.4. The Provider keeps the metadata of AI operations and keyword queries for 24 months, for Credit accounting and for checking the costs of the Service. It keeps the notifications displayed in the Application for 12 months, at most until the Account is deleted.
• Recipients: there is no external recipient; the Team Members of the Brand see each other's activity according to their Role (for example who created a piece of content).
• Source: the Data Subject and the use of the Service.
• Whether providing the data is mandatory: yes; these data arise from the use of the Service, and the Service cannot be provided without them.

5.4. Adding and inviting Team Members, team log

• Purpose: adding a Team Member to the Brand by adding an existing Account, by invitation or by an Account created on the Team Member's behalf; notifying the Team Member; keeping records of memberships and Roles; managing invitations; keeping the team log available to the Brand's Team Members.
• Data subjects: Team Members and invitees.
• Data processed: email address; name (if the inviting person does not provide it, the part of the email address before the @); Role; invitation data (the code of the invitation link, stored only in irreversible form, the expiry, the inviting person, the time of acceptance); team log entries (name, email address, event, time). A person opening the invitation link sees the invitee's email address, the name of the Brand and the name of the inviting person even without logging in. For an Account created on behalf of a Team Member, the Team Member receives an email for setting a password, the link in which is valid for 60 minutes.
• Legal basis: Article 6(1)(f) GDPR: the Customer's legitimate interest in using the Service together with the colleagues it designates, and the Provider's legitimate interest in keeping records of access and in its security. The legitimate interest assessment is available at the Data Subject's request.
• Retention period: membership data until the membership ends or until the Team Member's Account is deleted; the Account of a Team Member removed from the Brand remains until they delete it themselves. An invitation is valid until accepted, for a maximum of 7 days; the Provider deletes the data of an invitation not accepted 30 days after its expiry. Team log entries are kept for 730 days as part of the security log (Section 5.15).
• Recipients: MailerSend (invitation and notification emails); the Brand's Team Members, who see each other's names and email addresses and the team log.
• Source: the data of the invitee or of the Team Member are provided by the inviting Owner or Admin. The Provider informs the invitee about the processing in the first email sent to them and provides the location of the Privacy Notice.
• Whether providing the data is mandatory: the invitation cannot be sent without the invitee's email address; the invitee is not obliged to accept the invitation.

5.5. Payment, Subscription, refunds

• Purpose: processing payments on Stripe's payment page; managing the renewal and cancellation of the Subscription and changes of Plan; handling failed charges; making refunds, including under the voluntary money-back guarantee.
• Data subjects: the Owner paying the fee and the Customer ordering a One-off Service without an Account.
• Data processed: the identifier of the Organisation; the Plan and the period (monthly or annual); the identifiers issued by Stripe (customer, subscription and checkout session identifiers); the amount and time of the first payment; the time and amount of cancellation and of refunds; the declaration made when claiming the money-back guarantee; for an Order without an Account, the email address. Bank card details and the other data entered on the payment page are collected by Stripe; the Provider does not receive card data.
• Legal basis: Article 6(1)(b) GDPR (performance of the Contract). If the Owner pays the fee on behalf of a Business or another organisation, Article 6(1)(f) GDPR: the legitimate interest of the Customer and of the Provider in processing the payment. The legitimate interest assessment is available at the Data Subject's request.
• Retention period: until the termination of the Contract; the data supporting the accounting records for 8 years (Section 5.6); the declaration made when claiming the guarantee in accordance with Section 5.22.
• Recipients: Stripe, which is a processor in processing the payment and an independent controller with regard to fraud prevention and the legal obligations applicable to it (Section 3.3).
• Source: the Data Subject; Stripe, as regards the outcome of the payment and the status of the Subscription.
• Whether providing the data is mandatory: providing the data needed for payment is a condition of the Order; without them the Order cannot be fulfilled.

5.6. Invoicing, accounting

• Purpose: issuing the invoice for the fee, complying with accounting and tax obligations, and reporting invoice data to the state tax authority.
• Data subjects: a Customer who is a natural person (including a sole trader) and any other natural person shown on the invoice.
• Data processed: the mandatory content of the invoice, in particular the Customer's name, address and – if any – tax number, the description of the service, the consideration, the date of performance, and the date and serial number of the invoice; and the purchasing capacity given when the Order was placed (Consumer or Business), the Business's EU VAT number and the answer received to the check of the validity of that number.
• Legal basis: Article 6(1)(c) GDPR; the legal obligation is laid down in Section 169(2) of Act C of 2000 on Accounting (the “Számv. tv.”), Section 169 and Section 179(1) of Act CXXVII of 2007 on Value Added Tax (the “Áfa tv.”) and Section 78(3) of Act CL of 2017 on the Rules of Taxation (the “Art.”). Processing the purchasing capacity and the EU VAT number, including checking that number, likewise complies with a legal obligation: under Sections 37 and 169 of the Áfa tv., the place of supply and the content of the invoice depend on whether the customer is a taxable person.
• Retention period: 8 years (Section 169(2) of the Számv. tv.).
• Recipients: Billingo (issuing and electronic delivery of the invoice); the National Tax and Customs Administration of Hungary (Nemzeti Adó- és Vámhivatal, the “NAV”) as part of the invoice data reporting (Section 10.3); the name and address of a Customer who is a natural person not subject to VAT are not part of the reporting. The Provider checks the EU VAT number given by a Business in the European Commission's VIES system; the query transfers the EU VAT number (Section 10.1).
• Source: the Data Subject.
• Whether providing the data is mandatory: the processing is required by law; without the mandatory invoice data the Order cannot be fulfilled.

5.7. System messages, service notifications

• Purpose: sending notifications related to the operation of the Service by email and in the Application. These include in particular the confirmation of the Order, notifications of a payment problem, of the interruption of a Connected Account's connection, of the cancellation of the Subscription and of a failed publication, as well as approval requests, changes affecting Team Members and the delivery of a requested result (for example the Research Report).
• Data subjects: Users.
• Data processed: name, email address, the subject and content of the notification, notification settings. The Provider does not measure the opening of these emails or clicks on the links in them.
• Legal basis: as in Section 5.1, Article 6(1)(b) or (f) GDPR. For the confirmation of the Order, Article 6(1)(c) GDPR: Section 6:84(2) of the Ptk., Section 6(2) of Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (the “Ekertv.”) and, for a Consumer, Section 18 of Government Decree 45/2014 (II. 26.) on the Detailed Rules of Contracts between Consumers and Businesses (“Government Decree 45/2014”). The legitimate interest assessment is available at the Data Subject's request.
• Retention period: an email notification is complete when it is sent; the Provider keeps the notifications displayed in the Application for 12 months, at most until the Account is deleted, and the notification settings until the Account is deleted.
• Recipients: MailerSend.
• Source: the Data Subject and the use of the Service.
• Whether providing the data is mandatory: notifications can be switched off in the Application's settings, except for the notifications of a payment problem, of the interruption of a Connected Account's connection and of the cancellation of the Subscription, and the confirmation required by law; these are necessary for providing the Service.

5.8. Emails informing about the use of the Service

• Purpose: informing the User about the use of the Service: a reminder to complete the approval of the Brand Brief, a weekly summary of the Brand's activity, and a warning when 80% or 95% of the Monthly Credit Allowance has been used. These emails contain no offers; emails containing offers are covered by Section 5.9.
• Data subjects: the Team Members of the Brand with the relevant Role (the Owner and the Admin, and for the weekly summary also the Editor).
• Data processed: name, email address, Role, the status and activity of the Brand, Credit usage. The Provider does not measure the opening of these emails or clicks on the links in them.
• Legal basis: Article 6(1)(f) GDPR: the legitimate interest of the Provider and of the Customer in Users receiving the information needed to use the Service effectively. The legitimate interest assessment is available at the Data Subject's request.
• Retention period: until unsubscription or objection, at most until the Account is deleted.
• Recipients: MailerSend.
• Source: the Data Subject and the use of the Service.
• Whether providing the data is mandatory: no; the Data Subject can unsubscribe using the link in the emails or in the Application's notification settings, which has no effect on the use of the Service.

5.9. Advertising emails and newsletter

• Purpose: promoting the Provider's services by email: the newsletter and offers sent on the basis of the use of the Service (for changing the Plan, for buying Credits, for returning to the Service with Bonus Credits), and measuring the opening of these emails and clicks on the links in them. The recipients of the offers are selected automatically by the system on the basis of data on the use of the Service (Chapter 8).
• Data subjects: Users who have given their consent and persons who have subscribed to the newsletter.
• Data processed: name and email address; the time, method and source of giving and of withdrawing consent, and the version of the consent text; the IP address and the identifying data of the browser used when subscribing; for selecting offers, the Plan, the status of the Subscription, Credit usage and the time of the Account's last activity. The Provider also records the fact and time of the opening of an email and of a click on a link in it.
• Legal basis: Article 6(1)(a) GDPR (consent), which under Section 6(1) of Act XLVIII of 2008 on the Essential Conditions of and Certain Limitations to Business Advertising Activity (the “Grt.”) is also a condition for sending emails containing advertising. The Provider requests consent separately, by a checkbox that is not pre-ticked or by subscription, separately from the acceptance of the Terms, and keeps records of consents. Consent covers measuring the opening of emails and clicks on links by means of a pixel embedded in the email and tracked links; the Provider provides information on this when requesting consent. Consent may be withdrawn at any time, without giving reasons and free of charge: using the unsubscribe link in the emails, in the Application's notification settings, at [email protected] or by post to the Provider's registered office. Withdrawal does not affect the lawfulness of earlier processing.
• Retention period: until consent is withdrawn; on withdrawal, the Provider removes the Data Subject from the recipients without delay. An unconfirmed newsletter subscription is deleted when the confirmation link expires (7 days). After withdrawal, the Provider keeps the data proving the giving and withdrawal of consent (the time, the method and the email address in irreversible form) separately from the advertising mailing records, for a maximum of 5 years. The legal basis of this retention is Article 6(1)(f) GDPR: the Provider's legitimate interest in proving consent in the event of a legal claim or official proceedings, and in excluding further contact.
• Recipients: MailerSend (delivery of the emails, measuring opens and clicks); Google Workspace (the Provider's email).
• Source: the Data Subject; for selecting offers, the data generated during the use of the Service.
• Whether providing the data is mandatory: no; refusing or withdrawing consent has no effect on the use of the Service.

5.10. Referral programme

• Purpose: inviting a person recommended by the User to the Service with a referral link that the User shares on their own channel; tracking the status of the invitation; crediting Bonus Credits to the referrer and to the invitee.
• Data subjects: invitees and referring Users.
• Data processed: the referral code, the identifiers of the referring and of the invited User and of their Organisations, the status and times of the invitation.
• Legal basis: Article 6(1)(f) GDPR: the Provider's legitimate interest in acquiring customers through referrals and in settling the rewards. The legitimate interest assessment is available at the Data Subject's request.
• Retention period: for the time needed to check the conditions of the reward and to settle the credit, thereafter in accordance with the rules applicable to the Account and the Organisation. The Provider deletes the data of a referral invitation not accepted after 90 days.
• Recipients: none.
• Source: the invitee provides their own data when registering; the referrer's identifier is contained in the referral link.
• Whether providing the data is mandatory: no; using the referral link is voluntary; Section 5.1 applies to the registration data.

5.11. Contact, demo requests, sales outreach

• Purpose: replying to enquiries received through the Website's contact and demo request forms, arranging the demo, and forwarding the enquiry to the competent member of the Provider's staff. The Provider handles an enquiry on the topic „Adatvédelem” (Data protection) as a data subject request (Section 5.18). If the Data Subject gives separate consent on the contact, demo request or Quick Scan form, the Provider may contact them by email with offers relating to its services (sales outreach).
• Data subjects: persons sending an enquiry.
• Data processed: name, email address, company name, website, team size, the topic of the enquiry, the message and the answers to the qualifying questions, the time of submission, the IP address and the identifying data of the browser. For sales outreach, the data also include the time and method of giving and of withdrawing consent and the times of the outreach contacts.
• Legal basis: if the enquiry prepares a contract to be concluded by the Data Subject (for example a request for a demo or an offer), Article 6(1)(b) GDPR (steps taken at the request of the Data Subject prior to entering into a contract). Otherwise, Article 6(1)(f) GDPR: the legitimate interest of the Provider and of the Data Subject in replying to the enquiry. The legal basis for processing the IP address and the browser data is Article 6(1)(f) GDPR: filtering out unsolicited and automated submissions. The legal basis of sales outreach is Article 6(1)(a) GDPR (consent), which is also a condition of the outreach under Section 6(1) of the Grt. The Provider requests consent separately, by a checkbox that is not pre-ticked, and keeps records of it; without consent, it does not use the data of the enquiry for sales outreach. Consent may be withdrawn at any time, without giving reasons and free of charge: by replying to the outreach, at [email protected] or by post to the Provider's registered office. After withdrawal, the Provider does not contact the Data Subject for sales purposes; withdrawal does not affect the lawfulness of earlier processing. The legitimate interest assessment is available at the Data Subject's request.
• Retention period: 1 year from the closure of the enquiry; if a Contract is concluded as a result of the enquiry, Section 5.17 applies to further communication. Where consent to sales outreach has been given, the Provider keeps and uses the name, the email address and the company name until consent is withdrawn, for a maximum of 2 years from the Data Subject's last contact (for example an enquiry or a reply). Section 5.9 applies to the retention of the data proving consent.
• Recipients: MailerSend (the notification of the enquiry sent to the Provider's staff member); Google Workspace (the Provider's email, including sales outreach).
• Source: the Data Subject.
• Whether providing the data is mandatory: the enquiry cannot be answered without the name and the email address; providing the other data is voluntary. Consent to sales outreach is voluntary; refusing it has no adverse consequences.

5.12. Quick Scan

• Purpose: preparing the Quick Scan requested on the Website and sending the link to its result to the email address provided by the requester. If the requester takes out a Subscription with the same email address within 30 days, the Provider also uses the fact of the request to credit the promotional research bonus. If the requester gives separate consent to this, the Provider also uses the email address and company name provided for sales outreach (Section 5.11).
• Data subjects: persons requesting a Quick Scan.
• Data processed: email address, company name, the address of the website analysed, the result of the Quick Scan and the unique link to the results page. The data processed to prevent abuse are set out in Section 5.14.
• Legal basis: Article 6(1)(b) GDPR (performance of the free-of-charge contract for the Quick Scan). If the requester acts on behalf of a Business or another organisation, Article 6(1)(f) GDPR: the legitimate interest of the Provider and of the requester in preparing the requested analysis. The processing is not based on consent. The legitimate interest assessment is available at the Data Subject's request.
• Retention period: 90 days; thereafter the Provider deletes or anonymises the data of the request (the email address, the company name, the website address, the result and the link). Where consent to sales outreach has been given, it keeps the email address and the company name in accordance with Section 5.11, and the data needed to prove the acceptance of the Terms and the Highlighted Terms (including the email address) in accordance with Section 5.22.
• Recipients: the AI providers (the company name, the address and text of the website; not the email address), DataForSEO (the website's domain and keywords), Google PageSpeed Insights (the website address) and MailerSend (the email containing the link to the result).
• Source: the Data Subject; the text of the website from the publicly available website (Section 5.24).
• Whether providing the data is mandatory: the Quick Scan cannot be prepared without the email address, the company name and the website address. Anyone who has the link can open the results page, so the Data Subject should share the link only with persons of their choosing.

5.13. Ordering and performance of the One-off Service

• Purpose: ordering the One-off Service (without an Account from the Quick Scan results page, or from the Application), paying the fee, preparing the Research Report and delivering it by email (as a PDF attachment) and via a link; keeping the draft of an unpaid Order so that the purchase can be continued. This includes sending a reminder email as long as the person placing the order has not started the research, and starting the research without questions on the 30th day after payment.
• Data subjects: the Customer placing the order, if a natural person, and the User placing the Order.
• Data processed: email address, company name, the address of the website analysed, the answers of the person placing the order to the questions, the Research Report, the checkout session identifier, the fee paid, and the data of the draft.
• Legal basis: Article 6(1)(b) GDPR (performance of the Order); for the data proving payment, Article 6(1)(c) GDPR (Section 5.6). For the draft, Article 6(1)(f) GDPR: the legitimate interest of the Provider and of the person placing the order in being able to continue a purchase once started without entering the data again. The legitimate interest assessment is available at the Data Subject's request.
• Retention period: a Research Report not linked to an Account is available for 90 days; thereafter the Provider deletes the report, the PDF file, the email address, the answers and the website address. It keeps the data proving payment (the checkout session identifier, the fee, the company name) for 8 years (Section 5.6). It deletes an unpaid draft after 7 days. A Research Report ordered in the Application remains among the Organisation's data (Section 6.4).
• Recipients: Stripe, the AI providers, DataForSEO, Google PageSpeed Insights, Meta (Ad Library queries about competitors) and MailerSend. If the preparation of the Research Report fails, a designated member of the Provider's staff receives an internal notification containing the email address of the person placing the order in the Provider's email (Google Workspace).
• Source: the Data Subject; Stripe, as regards the outcome of the payment.
• Whether providing the data is mandatory: without the data needed for the Order, the One-off Service cannot be performed.

5.14. Prevention of abuse

• Purpose: preventing abusive, automated or repeated use of the free Quick Scan and of the Website's forms, and overloading of the system.
• Data subjects: persons requesting a Quick Scan and persons completing the Website's forms.
• Data processed: IP address; the identifying data of the browser; email address; the domain of the website analysed; an indication of whether the email address comes from a disposable email provider; a copy of the Quick Scan request stored among the enquiries (email address, company name, IP address, browser data).
• Legal basis: Article 6(1)(f) GDPR: the Provider's legitimate interest in keeping the free service sustainable and in preventing the abusive use of paid external services and overloading; this also serves the interests of the other visitors. The rules: at most one Quick Scan is prepared for an email address and for a domain within 30 days; at most 20 requests per hour are accepted from an IP address; requests with an address from a disposable email provider are not accepted. The legitimate interest assessment is available at the Data Subject's request.
• Retention period: an IP-based rate limit entry is kept for a maximum of 1 hour; the email address, the domain and the copy stored among the enquiries are kept for the same period as the Quick Scan data, 90 days.
• Recipients: none.
• Source: the Data Subject.
• Whether providing the data is mandatory: the data arise automatically when the Quick Scan and the forms are used; without them the request cannot be accepted.

5.15. Security log

• Purpose: the security of the Service and of the Accounts, the detection of unauthorised access and abuse, the subsequent traceability of operations – including provider access (Section 5.17) – and the team log available to the Brand's Team Members.
• Data subjects: Users, Team Members, invitees and External Reviewers.
• Data processed: the identifier and type of the person performing the operation (User, member of the Provider's staff, provider access); the operation, its subject and time; the IP address; additional data (for team operations the email address, for errors the error message). The events logged include in particular: successful and failed logins, registration, password resets, changes in memberships and Roles, data protection requests, Subscription and refund events, the creation, approval and publication of content, the decision of an External Reviewer, and the management of Connected Accounts.
• Legal basis: Article 6(1)(f) GDPR: the legitimate interest of the Provider and of the Customer in the security of the Service and the Accounts, in detecting abuse and in being able to prove operations. The legitimate interest assessment is available at the Data Subject's request.
• Retention period: 730 days; the system deletes expired entries weekly. Deleting the Account does not shorten the retention period.
• Recipients: there is no external recipient; the Brand's Team Members see the membership entries of the team log (name, email address); the full log is accessible to authorised members of the Provider's staff.
• Source: generated automatically during the use of the Service.
• Whether providing the data is mandatory: logging cannot be switched off; the Service cannot be used without it.

5.16. Technical and error logs

• Purpose: operating the Website and the Application, detecting and fixing errors, and protecting the security of the system.
• Data subjects: visitors to the Website and Users.
• Data processed: IP address, the identifying data of the browser, the time, address and result of the request, error messages, the data of failed background jobs (which may also contain an email address or other personal data).
• Legal basis: Article 6(1)(f) GDPR: the Provider's legitimate interest in operating the Website and the Application securely and without errors. The legitimate interest assessment is available at the Data Subject's request.
• Retention period: for the time needed to fix errors and to investigate security events, for a maximum of 90 days; thereafter the Provider deletes the log entry.
• Recipients: Cloudflare, Inc., which forwards the traffic of the Website and the Application, as a processor (Section 10.1); there is no other external recipient.
• Source: generated automatically during the use of the Website and the Application.
• Whether providing the data is mandatory: the data arise automatically during use; without them the Website and the Application cannot be operated.

5.17. Customer support, complaint handling, provider access to the Account

• Purpose: handling the questions, error reports and complaints of Customers and Users; handling a Consumer's complaint received through the Website's reporting form, by email or by post; access to the Account by an authorised member of the Provider's staff with the User's permissions in order to handle a support request, troubleshoot or deal with a security incident (provider access).
• Data subjects: Customers, Users and complainants.
• Data processed: name, email address, the correspondence, the complaint and the reply. For provider access: the start and end of the access (in a session of no more than 30 minutes), the identifier of the staff member and the operations performed in the meantime; during the access, the staff member sees the data that the User can also access.
• Legal basis: Article 6(1)(b) GDPR if the Data Subject is the Customer; otherwise Article 6(1)(f) GDPR: replying to the enquiry, troubleshooting and the security of the Service. For a Consumer's complaint, Article 6(1)(c) GDPR and Section 17/A(7) of Act CLV of 1997 on Consumer Protection (the “Fgytv.”). For troubleshooting and dealing with a security incident, provider access may take place without prior notice to the User. The legitimate interest assessment is available at the Data Subject's request.
• Retention period: a Consumer's complaint and the reply to it for 3 years (Section 17/A(7) of the Fgytv.); other correspondence until the request is closed, and in the event of a dispute in accordance with Section 5.21; the provider access log for 730 days (Section 5.15).
• Recipients: MailerSend (notifications sent from the Application and the confirmation of receipt of complaints); Google Workspace (the Provider's email).
• Source: the Data Subject; the provider access log is generated automatically.
• Whether providing the data is mandatory: without the data needed to investigate the enquiry or the complaint, it cannot be investigated.

5.18. Handling of data subject requests

• Purpose: fulfilling the Data Subject's requests under Chapter 12 and proving their fulfilment.
• Data subjects: persons submitting a request.
• Data processed: name, email address, the subject and content of the request, the data needed for identification, the method and time of fulfilment; for a data export started in the Application and for the deletion of the Account, the type and time of the request (without the content of the data provided).
• Legal basis: Article 6(1)(c) GDPR, on the basis of Article 12(3)–(4) and Articles 15–22 GDPR. The legal basis of retention after the request has been fulfilled is Article 6(1)(f) GDPR: the Provider's legitimate interest in proving that it acted lawfully (Section 5.21).
• Retention period: 5 years from the fulfilment of the request, to prove fulfilment (Section 6:22(1) of the Ptk.).
• Recipients: if the request concerns the Customer's processing, the Customer (Section 6.2); Google Workspace (the Provider's email).
• Source: the Data Subject.
• Whether providing the data is mandatory: without the data needed for identification the request cannot be fulfilled (Article 12(6) GDPR).

5.19. Consumer withdrawal and termination

• Purpose: exercising the Consumer's right of withdrawal and right of termination with the Application's “Withdraw from contract here” („Elállás a szerződéstől”) function, through the Website's reporting form, by email or with the model form; sending the acknowledgement of receipt; settlement and refund.
• Data subjects: Consumers.
• Data processed: name, email address, the Consumer's postal address (if provided), the identifiers of the Contract and of the Order, the content, date and time of the withdrawal or termination, the acknowledgement of receipt, refund data.
• Legal basis: Article 6(1)(c) GDPR and Sections 22–23 of Government Decree 45/2014. The legal basis of retention after the withdrawal or termination has been settled is Article 6(1)(f) GDPR: the Provider's legitimate interest in proving that it acted lawfully (Section 5.21).
• Retention period: 5 years from the termination of the Contract, for the resolution of any disputes (Section 5.21); the data proving the refund for 8 years (Section 5.6).
• Recipients: Stripe (refund), MailerSend (acknowledgement of receipt), Google Workspace (a declaration made by email).
• Source: the Data Subject.
• Whether providing the data is mandatory: when using the withdrawal function, the Consumer provides their name, the identifying data of the Contract and the electronic contact details to which they request the acknowledgement of receipt (Section 22(1a) of Government Decree 45/2014); without these the declaration cannot be identified.

5.20. Notices of illegal content, moderation, complaints

• Purpose: receiving and assessing notices concerning illegal content stored in the Service, received through the Website's reporting form or by email, communicating the decision, stating the reasons for content moderation measures, deciding on complaints, and conducting the notice procedure for copyright and trade mark infringements.
• Data subjects: notifiers, and the Customers and Users concerned.
• Data processed: the notifier's name and email address, the explanation of the notice, the exact location of the content, the declaration of good faith, the decision and the reasons for it, the complaint and the reply to it.
• Legal basis: Article 6(1)(c) GDPR; the legal obligation is laid down in Articles 16–17 of Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act) (the “DSA”), Section 3 of Act CIV of 2023 on Certain Rules of Online Intermediary Services (the “Iszt.”) and, for copyright and trade mark infringements, Section 13 of the Ekertv. The legal basis of retention after the decision is Article 6(1)(f) GDPR: the Provider's legitimate interest in proving that it acted lawfully (Section 5.21).
• Retention period: 5 years from the decision (Section 5.21).
• Recipients: MailerSend (confirmation of receipt of the notice); Google Workspace (the Provider's email); the Customer concerned is informed of the decision and the reasons for it; the Provider discloses the notifier's identity to the Customer only if required by law or indispensable for the assessment. At the request of an authority or a court, the Provider may transfer the data in accordance with Section 10.3.
• Source: the notifier; the data relating to the Customer and the User concerned may also come from the notice.
• Whether providing the data is mandatory: without the data listed in Article 16(2) DSA the notice cannot be fully assessed. Providing the notifier's name and email address is not mandatory if the notice concerns an offence relating to child sexual abuse.

5.21. Legal claims, requests from authorities

• Purpose: the establishment, exercise and defence of legal claims; responding to requests from authorities and courts.
• Data subjects: Customers, Users and other persons concerned by the dispute or the request.
• Data processed: the contractual, correspondence, log and payment data needed for the dispute or the request.
• Legal basis: for legal claims, Article 6(1)(f) GDPR: the Provider's legitimate interest in establishing, exercising and defending its legal claims; for requests from authorities, Article 6(1)(c) GDPR and the legislation authorising the request. The legitimate interest assessment is available at the Data Subject's request.
• Retention period: until the claim becomes time-barred, as a general rule 5 years from the termination of the Contract or from the claim becoming due (Section 6:22(1) of the Ptk.); in the case of pending proceedings, until their final conclusion.
• Recipients: courts, authorities, the Provider's legal representative (Section 10.3).
• Source: the Provider's records, and the other persons and bodies participating in the dispute or the proceedings.
• Whether providing the data is mandatory: no separate provision of data by the Data Subject is required; the data come from the Provider's existing records.

5.22. Records of contractual declarations

• Purpose: proving the conclusion of the Contract, the acceptance of the Terms and the Highlighted Terms, and the making of declarations relating to the Contract.
• Data subjects: Users, Customers, and persons requesting a Quick Scan or placing an order without an Account.
• Data processed: the fact of the acceptance of the Terms and the Highlighted Terms, the number of the accepted version, the time and method of acceptance (for example registration, Quick Scan, Order without an Account), the IP address and the identifying data of the browser used, the identifiers of the User and the Organisation, and for acceptance without an Account the email address of the accepting person; the acknowledgement of the warning displayed when the Autopilot is switched on; the time of the declaration of entitlement made when uploading Source Material; the declaration made when claiming the money-back guarantee; the declaration of the purchasing capacity made when the Order was placed (Consumer or Business); for a Consumer, the separate declaration accepting the properties of Generated Content (Terms Section 15.6), the request to start performance and the related acknowledgement (Terms Section 15.3); the declaration of acceptance made on Stripe's payment page.
• Legal basis: Article 6(1)(f) GDPR: the Provider's legitimate interest in proving the conclusion of contracts and the contractual declarations made. The legitimate interest assessment is available at the Data Subject's request.
• Retention period: 5 years from the termination of the Contract (Section 6:22(1) of the Ptk.).
• Recipients: Stripe (the declaration made on the payment page).
• Source: the Data Subject; Stripe, as regards the fact of the declaration made on the payment page.
• Whether providing the data is mandatory: without the declaration of acceptance the Contract is not concluded, or the operation tied to the declaration cannot be started.

5.23. Storage on the Website and in the Application; web analytics and advertising tracking

• Purpose: storage strictly necessary for the operation of the Website and the Application (session, protection against request forgery, cookie choice, language, theme and interface state); measuring visits to the Website with Google Analytics 4, solely on the basis of consent. With consent, the Provider also measures the effectiveness of its advertisements and targets its advertisements by means of the advertising tracking technologies under Section 9.6.
• Data subjects: visitors to the Website and Users.
• Data processed: the content of the storage items listed in Chapter 9; when Google Analytics 4 is used, the cookie identifier, the address of the page viewed, the actions taken on the Website (for example a button click, the frequently asked question opened, the referring page), device and browser data, and the IP address. When the advertising tracking technologies are used, the same data, supplemented by the ad click identifier.
• Legal basis: strictly necessary storage does not require consent (Section 9.1); the legal basis of the related processing is Article 6(1)(f) GDPR: the Provider's legitimate interest in operating the service requested by the Data Subject. The legal basis for Google Analytics 4 and the advertising tracking technologies is consent under Section 155(4) of Act C of 2003 on Electronic Communications (the “Eht.”) and Article 6(1)(a) GDPR. The legitimate interest assessment is available at the Data Subject's request.
• Retention period: as set out in the tables in Sections 9.2 and 9.3; the Provider stores the event data collected in Google Analytics 4 for 2 months (the retention period set in the Google Analytics account). The data transmitted by the advertising tracking technologies are retained by Google, Meta and LinkedIn in accordance with their own rules (Section 9.6).
• Recipients: Google (Google Analytics 4, Google Ads), Meta (Meta Pixel) and LinkedIn (LinkedIn Insight Tag).
• Source: the Data Subject's device.
• Whether providing the data is mandatory: consent to Google Analytics 4 and to the advertising tracking technologies is not mandatory, and refusing it has no adverse consequences; without strictly necessary storage the Website and the Application do not work.

5.24. Data collected from public sources in research

• Purpose: preparing the Quick Scan and the One-off Service ordered without an Account: analysing the text, technological features and prices of the website analysed and of competitors' websites, and the advertisements published in Meta's Ad Library. With regard to the data collected during SEO and GEO research started in the Application (including the research monitor and the One-off Service ordered in the Application), the Provider is the Customer's processor; Chapter 6 covers this.
• Data subjects: natural persons appearing on the researched websites and in advertisements (for example sole traders, staff members named on the website).
• Data processed: text excerpts from the websites (at most 4,000 characters per page are sent to the AI provider), the technologies and tracking codes used on the website, prices, the text and date of advertisements and the link to their display in the Ad Library. The Provider does not deliberately collect contact data (name, telephone number, email address).
• Legal basis: Article 6(1)(f) GDPR: the Provider's legitimate interest in preparing the analysis requested by the requester. The legitimate interest assessment is available at the Data Subject's request.
• Retention period: for as long as the result of the Quick Scan or the Research Report is kept, for a maximum of 90 days (Sections 5.12 and 5.13); in the temporary stores used during processing, the data are kept for a maximum of 30 days.
• Recipients: the AI providers, DataForSEO, Google PageSpeed Insights and Meta (Ad Library queries).
• Source: publicly available websites, Meta's Ad Library and DataForSEO's search database.
• Whether providing the data is mandatory: the Data Subject does not provide any data. Informing the Data Subjects individually would involve a disproportionate effort, as the Provider does not collect the contact details of the persons appearing on the researched websites; the Provider therefore fulfils its obligation to provide information by publishing the Privacy Notice (point (b) of Article 14(5) GDPR).

6.1. When the Provider is a processor

With regard to the personal data contained in Customer Content and Generated Content, the controller is the Customer, and the Provider is a processor acting on behalf of and on the instructions of the Customer. This includes in particular:

• (a) the Brand Brief and the answers to the onboarding questions;
• (b) Source Materials and the data of the persons appearing in them – in documents, in images and in the audio track of videos;
• (c) the text read from the websites provided – including the websites examined in research started in the Application and with the research monitor;
• (d) content, edits, comments and conversations with the AI content-editing assistant (in the interface: “Writing partner”; in Hungarian: „Szerkesztőtárs”);
• (e) the data of Connected Accounts (Section 6.5);
• (f) the names and comments of External Reviewers (Section 6.3);
• (g) Research Reports and their public sharing links;
• (h) the data transmitted to the Customer's website and to the webhook address specified by it.

The Provider processes these data solely for the purpose of the Service provided to the Customer. If the Customer is itself a processor (on behalf of its own clients), the Provider acts as a further processor. The Provider does not collect the data of persons reacting to published content (comments, likes, follows).

6.2. Whom the Data Subject should contact

The Data Subject may address requests concerning data contained in Customer Content and Generated Content to the Customer as controller. If a request reaches the Provider, the Provider forwards it to the Customer without undue delay and notifies the Data Subject of the forwarding, without naming the Customer. Informing the Data Subjects – including telling them that their data are processed in the Service – is the Customer's responsibility.

6.3. External Reviewers

The User may share content for review via a link that is valid for at least 1 and at most 90 days. Anyone who has the link can view the content without an Account and add a comment to it by entering their name. The Provider processes the External Reviewer's name and comment as the Customer's processor; the controller is the Customer, which is also responsible for informing the External Reviewers. Holders of the link see each other's names and comments. The Provider processes the IP address recorded when an External Reviewer makes a decision for its own security purposes (Section 5.15).

6.4. Method and duration of the processing

The Provider stores Customer Content and Generated Content on its own infrastructure, creates a vector search index from text excerpts for searching within the Brand, and transmits them to AI providers in accordance with Chapter 7. The recipients engaged in this context are marked as such in the “Sub-processor” column of Section 10.1. The Provider permanently deletes content and Source Materials deleted by the User – together with the original files of videos – after 30 days. The fate of the data on termination of the Contract is governed by Terms Sections 14.7 and 14.8, and on deletion of the Account by Section 12.4.

6.5. Data of Connected Accounts

When a Connected Account is connected, the Provider stores the following data: the external identifier, name and username of the account or page; for a LinkedIn profile, the name and identifier of the profile owner; the encrypted access token, the permissions granted and their expiry; for a website, the login details and the connection settings. When a Connected Account is disconnected, the Provider deletes the access token and the login details – for a website, also the custom HTTP headers; it keeps the identifier and name of the account until the Organisation is deleted, in order to keep records of earlier publications. The Provider does not revoke the permission given in the Third-party Service; the Data Subject can revoke it in the settings of the Third-party Service.

7.1. Data that reach AI providers

The AI model receives the data needed to perform the task:

• (a) the Brand Brief, the brand voice settings and the answers to the onboarding questions;
• (b) text excerpts selected for the task from the Brand's knowledge base: text extracted from Source Materials, the recognised text of images and scanned pages, transcripts of videos, the text of websites;
• (c) images and scanned pages uploaded as Source Material (for image recognition and content moderation), and the audio track of videos (for transcription);
• (d) the content being edited, the last 10 turns of the conversation with the Writing partner, and the Users' manual corrections, for learning the brand voice;
• (e) in research, text excerpts from the websites analysed (at most 4,000 characters per page), the name of the Brand and the market;
• (f) for the AI-assisted set-up of a website connection, the programming documentation and connection data pasted in by the Customer;
• (g) the image generation prompt, which is also checked by content moderation.

The Provider does not pass the User's name and email address to the AI provider, unless the User writes them into the text being processed. Most of the data reaching the AI provider is Customer Content, for which the Provider is a processor (Chapter 6); for the Quick Scan and the One-off Service ordered without an Account – including the data collected there from public sources – the Provider is a controller (Sections 5.12, 5.13 and 5.24). The Provider does not store the text of the requests sent to the model or of the model's responses in the log of AI operations (Section 5.3); Generated Content remains among the Organisation's data.

7.2. AI providers and the place of processing

The AI providers – OpenAI and Anthropic – and the place of processing are set out in Section 10.1. OpenAI and Anthropic process the data in the United States of America; Section 10.2 applies to this. Transcripts of the audio track of videos are primarily produced by the Provider's own AI system operated in Hungary (Topin AI), and by OpenAI if that system is unavailable. The Provider selects the AI provider used for each task according to the nature of the task.

7.3. Model training and retention by the AI provider

The Provider does not use Customer Content or Generated Content to train AI models. This is consistent with Terms Section 12.4. The Provider does not train or fine-tune any AI model.

The AI providers' own terms (as at 14 October 2026) provide as follows:

• (a) OpenAI does not use the data submitted through its programming interface to train or improve its models unless the customer has expressly consented to this; the Provider has given no such consent. OpenAI retains the logs used for abuse monitoring for a maximum of 30 days, unless longer retention is required by law or for the protection of its services; by default, it stores requests and responses using web search for a maximum of 30 days;
• (b) under Anthropic's commercial terms, Anthropic does not train models on the content submitted by the customer in its services.

The AI providers' terms may change; the Provider will amend this Section accordingly.

7.4. Machine-readable marking of generated content

In accordance with Article 50(2) of the AI Act, the Provider embeds a digital watermark (Adobe TrustMark) in images generated with artificial intelligence; the watermark is invisible to the naked eye and survives usual compression and resizing. It marks generated texts in a machine-readable way in the metadata of the outputs (application programming interface, webhook, data export, the metadata of posts sent to a website). The watermark contains no personal data, only the fact of artificial generation and a short internal content identifier. Anyone may check free of charge whether an image carries a Pagioo AI marking on the https://pagioo.com/mi-jeloles/ page or directly at https://app-api.pagioo.com/api/public/ai-mark/detect; the Provider does not store images uploaded for this check and, to prevent abuse, processes the IP address of the request for no longer than one day (on the basis of Article 6(1)(f) GDPR).

9.1. Rules on storage on the device

The Website and the Application use cookies and similar technologies – the browser's local storage (localStorage), session storage (sessionStorage) and cache (Cache Storage). Under Section 155(4) of the Eht., data may be stored on the Data Subject's device, or data stored there may be accessed, on the basis of the Data Subject's consent given after clear and comprehensive information. This provision of the Eht. is based on Article 5(3) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications). Under the Directive, no consent is required for storage that is strictly necessary to provide a service explicitly requested by the Data Subject.

Without consent, the Provider uses only such strictly necessary storage: to maintain the logged-in session, to protect against request forgery, to remember the cookie choice, to keep the language, appearance and interface state chosen by the Data Subject, and to keep the referral code needed to credit the Bonus Credit requested by the Data Subject. For all other storage – the cookies of Google Analytics 4 and of the advertising tracking technologies under Section 9.6 – it requests prior consent. The legal basis of the processing related to strictly necessary storage is set out in Section 5.23.

9.2. Storage used by the Website

The Website does not set any cookie of its own; it records choices in the browser's local storage. The Website's storage items are listed in the table below.

9.3. Storage used by the Application

The Application uses only the storage needed for its operation; it does not use web analytics. The Application's storage items are listed in the table below.

The content of local storage is not deleted on logout; on a shared device, the Data Subject can remove it by clearing the browser's data.

9.4. Giving and withdrawing consent

In the banner shown when the Website is first opened, the Data Subject can decide with the „Csak a szükségesek” (Necessary only), „Beállítások” (Settings) and „Összes engedélyezése” (Allow all) buttons; under „Beállítások” (Settings), they can also choose by category (analytics, marketing), and the checkboxes are unticked by default. The banner offers the same three options on the pages in every language. Without consent, only the storage items under Section 9.2 that do not require consent work. Consent to the analytics category enables Google Analytics 4 (Section 9.5) to be loaded, and consent to the marketing category enables the advertising tracking technologies (Section 9.6) to be loaded.

Consent can be withdrawn at any time as easily as it was given: on the Website's „Süti-beállítások” (Cookie settings) page (https://pagioo.com/cookie/) or with the button placed below this Section, the choice can be deleted, after which the banner appears again. After withdrawal, Google Analytics 4 and the advertising tracking technologies are not loaded; on withdrawal the Website deletes the cookies set on its own domain, and the Data Subject can delete cookies set on third-party domains in the browser's settings. Withdrawal does not affect the lawfulness of earlier processing.

9.5. Google Analytics 4

The Provider uses the Google Analytics 4 service to measure visits to the Website, solely after the Data Subject's prior consent; without consent, the Google Analytics code is not loaded and no request reaches Google. Google Analytics measures the pages viewed and the actions taken on the Website on the basis of the cookie identifier; no name or email address reaches it. The device's IP address reaches Google when the request is received. The service is provided by Google Ireland Limited, which may also transfer the data to Google LLC in the United States of America (Section 10.2).

9.6. Advertising tracking technologies

The Provider uses advertising tracking technologies on the Website solely on the basis of the Data Subject's prior consent to the marketing category (Section 155(4) of the Eht.; Article 6(1)(a) GDPR; Section 5.23). Their purpose is to measure the effectiveness of the Provider's advertisements (to establish whether an ad click is followed by a registration or an Order) and to show advertisements to people who have previously visited the Website. The Provider uses the following technologies:

• (a) Google Ads (Google Ireland Limited);
• (b) Meta Pixel (Meta Platforms Ireland Limited);
• (c) LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company).

Without consent, the code of these technologies is not loaded and no request reaches Google, Meta or LinkedIn. With consent, the operator of the technology concerned receives the cookie identifier, the address of the page viewed, the action taken on the Website, the ad click identifier, device and browser data, and the IP address; it does not receive the name or the email address. The names and lifetimes of the cookies are set out in the table in Section 9.2.

Meta and LinkedIn are joint controllers with the Provider for the collection and transmission of the data. The essence of the arrangement on joint controllership is that the Provider is responsible for informing the Data Subject and for obtaining consent, and Meta or LinkedIn, respectively, is responsible for the further processing of the transmitted data; the Data Subject may exercise their rights against the Provider and also against Meta or LinkedIn. After the transmission, Meta and LinkedIn process the transmitted data as independent controllers. Google processes the Google Ads data as an independent controller under its own terms; the Provider is responsible for collecting the data and transmitting them to Google. Google, Meta and LinkedIn may also transfer the data to the United States of America (point (g) of Section 10.2); their own privacy notices apply to this: https://policies.google.com/privacy, https://www.facebook.com/privacy/policy and https://www.linkedin.com/legal/privacy-policy.

10.1. Recipients and processors

The processors engaged by the Provider and the other recipients are listed in the table below; this is also the single list of Sub-processors. The “Sub-processor” column indicates whether the recipient takes part in the processing of Customer Content and Generated Content.

10.2. Transfers to third countries

The Provider transfers personal data to countries outside the European Economic Area (third countries) in the following cases, in each case with the safeguard indicated:

• (a) OpenAI: OpenAI processes the data in the United States of America; the safeguard is the standard data protection clauses included in OpenAI's data processing terms, which the Provider has accepted;
• (b) Anthropic: Anthropic processes the data in the United States of America; the safeguard is the standard data protection clauses included in Anthropic's data processing terms, which the Provider has accepted;
• (c) Cloudflare, Inc.: the safeguard is the adequacy decision (EU-US Data Privacy Framework), with standard data protection clauses as a fallback according to Cloudflare;
• (d) MailerSend, Inc.: the safeguard is the adequacy decision (EU-US Data Privacy Framework);
• (e) Google LLC (Google PageSpeed Insights, and the transfer of Google Analytics 4 and Google Workspace data): the safeguard is the adequacy decision (EU-US Data Privacy Framework);
• (f) Stripe: the safeguard for the transfers it makes as a processor in processing payments is the safeguard indicated in Stripe's data processing terms (standard data protection clauses or – for a recipient certified under the EU-US Data Privacy Framework – the adequacy decision). Stripe itself is responsible for the transfers it makes as an independent controller; its own privacy notice applies to them;
• (g) Google, for login with a Google account and for Google Ads, and Meta and LinkedIn, for publication and advertising tracking, are responsible as controllers in their own right for their own transfers; their own privacy notices apply to them.

Adequacy decision means Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework, which found that organisations certified under the EU-US Data Privacy Framework ensure an adequate level of protection (Article 45 GDPR). Standard data protection clauses means the standard contractual clauses for the transfer of personal data to third countries adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (point (c) of Article 46(2) GDPR).

The Data Subject may request a copy of the safeguards at [email protected]. The Provider does not claim that all data remain in the European Union at every processing step. If the EU-US Data Privacy Framework ceases to be applicable, the Provider will base the transfer concerned on standard data protection clauses or will stop it.

10.3. Authorities and other recipients

The Provider may transfer personal data on the basis of law, or for the establishment, exercise or defence of legal claims:

• (a) to the NAV as part of the invoice data reporting (Section 5.6);
• (b) to courts, the public prosecutor's office, investigating authorities, the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, the “NAIH”), the consumer protection authority and other authorities, if they request it on a legal basis;
• (c) to the Provider's legal representative, for the establishment, exercise or defence of legal claims (Section 5.21);
• (d) to the Provider's legal successor or – in the event of a transfer of the Contract – to the transferee.

10.4. Changes to the list

The Provider notifies Customers of changes to the recipients marked as Sub-processors in Section 10.1 in accordance with Section M1.7 of Annex 1 to the Terms. Any change to Section 10.1 takes effect towards Data Subjects upon the publication of the amended Privacy Notice.

11.1. Data security

The Provider protects the security of personal data in accordance with Article 32 GDPR with technical and organisational measures proportionate to the risks, in particular the following:

• (a) the Website and the Application can be accessed via an encrypted (TLS) connection;
• (b) Customers' data are stored logically separated by Organisation and by Brand, and the separation is checked by automated tests during development;
• (c) access is tied to Roles;
• (d) the Provider stores passwords in irreversible (hashed) form, and the access tokens of social media accounts and the passwords and secret keys provided for websites in encrypted form;
• (e) it stores the keys issued for the programming interface and the codes of invitation, reviewer and sharing links only in irreversible form;
• (f) it limits login attempts;
• (g) it logs operations that are relevant to security (Section 5.15);
• (h) when fetching web addresses provided by the User, it blocks access to internal network addresses;
• (i) it makes regular, encrypted backups of the database and of the uploaded files, keeps them for a maximum of 3 months, and accesses them solely for the purpose of restoration.

The risk of data transmission over the internet cannot be completely excluded. The User is responsible for keeping their login details secret; if they detect unauthorised access to their Account, they should report it without delay at [email protected].

11.2. Personal data breach

The Provider notifies the NAIH of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons (Article 33 GDPR). If the breach is likely to result in a high risk, the Provider also informs the Data Subjects concerned without undue delay, in clear and plain language (Article 34 GDPR). The Provider keeps records of all breaches. If the breach affects Customer Content or Generated Content, the Provider, as processor, notifies the Customer and provides it with the information needed for the notification.

12.1. The rights and how to exercise them

Under Articles 15–22 GDPR, the Data Subject has the right of access (Section 12.2), the right to rectification (Section 12.3), the right to erasure (Section 12.4), the right to restriction of processing (Section 12.5), the right to data portability (Section 12.6), the right to object (Section 12.7) and the right to withdraw consent (Section 12.8). Requests may be sent to the email address [email protected] or by post to the Provider's registered office. In the “Privacy & data” section of the Application's “Settings” menu, the User can also download a summary of their data themselves (Section 12.6) and delete their Account (Section 12.4). If the request concerns Customer Content or Generated Content, Section 6.2 applies.

12.2. Access

The Data Subject may request information as to whether the Provider processes their personal data (Article 15 GDPR). If so, they receive a copy of the data and information on the purposes of the processing, the categories of data, the recipients, the safeguards for transfers to third countries, the retention period, their rights, the source of the data and automated decision-making. The first copy is free of charge; for further copies, the Provider may charge a reasonable fee based on administrative costs. Providing the copy must not adversely affect the rights and freedoms of others.

12.3. Rectification

The Data Subject may request the rectification of inaccurate data concerning them and the completion of incomplete data (Article 16 GDPR). The name and the email address cannot currently be changed in the Application; the Provider rectifies them at a request submitted by email.

12.4. Erasure

The Data Subject may request the erasure of their data if the data are no longer needed for the purpose of the processing, if they have withdrawn their consent, if they have successfully objected, or if the processing is unlawful (Article 17 GDPR).

The User can delete their Account in the Application themselves. Deletion is immediate and irreversible, without a grace period; the Provider carries out the following:

• (a) it replaces the name and the email address with a marker unsuitable for identification, ends the possibility of logging in, and deletes the sessions, the password reset codes and the data of the link with the Google account;
• (b) all of the User's memberships end;
• (c) if the User is the sole Owner of the Organisation, the other Team Members of the Organisation also lose their access; the end of the Subscription and the other contractual consequences are set out in Terms Section 14.4.

After the Account is deleted, the following data remain, for the reason and the period indicated:

• (d) the Customer Content and Generated Content created by the User in the Organisation's Brands remain the data of the Organisation (the Customer) as long as there is an active Team Member in the Organisation; the person who created them can no longer be identified;
• (e) security log entries, for 730 days (Section 5.15);
• (f) accounting documents and the data supporting them, for 8 years (Section 5.6);
• (g) contractual declarations and the data needed for legal claims, for 5 years (Sections 5.21 and 5.22);
• (h) the record of the erasure request (Section 5.18);
• (i) the data of other processing linked to the same email address (for example an enquiry, the newsletter, a Quick Scan, a referral invitation), in accordance with their own Section; the Data Subject may request their erasure separately;
• (j) the data processed by Stripe as an independent controller, in accordance with Stripe's own rules; the Data Subject may also request their erasure from Stripe directly.

If no active Team Member remains in the Organisation, the Provider permanently deletes the Organisation's content 90 days after that time, except for the data indicated in points (e)–(h). This happens in particular if the Accounts of all Users have been deleted, or the sole Owner has deleted their Account. The Customer may also request the deletion of the Organisation's content by email; in that case Terms Section 14.8 applies to the time of deletion. If the deleted data are also contained in a backup, they are deleted from it at the end of the backup's retention period. Erasure cannot be carried out if the processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims (points (b) and (e) of Article 17(3) GDPR).

Deleted data may remain in the Provider's encrypted backups until the end of the backup cycle, for a maximum of 3 months; the Provider accesses these solely for the purpose of restoration and, if it restores data from a backup, it re-executes the erasure requests fulfilled in the meantime.

12.5. Restriction of processing

The Data Subject may request the restriction of processing (Article 18 GDPR) if:

• (a) they contest the accuracy of the data – for the period needed to verify their accuracy;
• (b) the processing is unlawful but the Data Subject opposes erasure;
• (c) the Provider no longer needs the data, but the Data Subject requires them for a legal claim;
• (d) the Data Subject has objected, and the verification of whether the Provider's legitimate grounds override is pending.

Where processing is restricted, the Provider processes the data – apart from storing them – only with the Data Subject's consent or for the purposes specified in Article 18(2) GDPR.

12.6. Data portability

The Data Subject may receive the data they have provided which are processed by automated means on the basis of consent or a contract in a structured, commonly used and machine-readable format, and may request that they be transmitted to another controller (Article 20 GDPR).

In the Application, the User can download a summary of their data (in JSON format). The summary contains the Account data, memberships, notification settings, the identifier, title, status, type and dates of the User's content (without the text of the content), the Brands' publications, the data of Source Materials (without the files), the metadata of AI operations, and the security log entries in which the User is the person who performed the operation. The summary contains at most 5,000 items per part; if a part contains more items, the Provider provides the full set of data at a request submitted by email. The text of content, the original files of Source Materials and Research Reports qualify as Customer Content or Generated Content. The Customer may request their release – also on termination of the Contract and on switching – in accordance with Terms Section 14.7, and the Data Subject may contact the Customer in accordance with Section 6.2.

12.7. Objection

12.8. Withdrawal of consent

Where processing is based on consent, the Data Subject may withdraw their consent at any time, without giving reasons and free of charge, as easily as it was given (Article 7(3) GDPR). Consent to advertising emails and the newsletter may be withdrawn in accordance with Section 5.9 – using the unsubscribe link in the emails, in the Application's notification settings, by email or by post – and consent to cookies in accordance with Section 9.4. Consent to sales outreach may be withdrawn in accordance with Section 5.11. Withdrawal does not affect the lawfulness of processing before withdrawal.

12.9. Time limit, charges and identification

The Provider responds to a request without undue delay and in any event within 1 month of its receipt. This period may be extended by a further 2 months, taking into account the complexity and number of the requests; the Provider informs the Data Subject of any extension and of the reasons for it within the 1-month period. If the Provider does not take action on the request, it informs the Data Subject within the 1-month period of the reasons for not taking action and of the possibility of lodging a complaint with the NAIH and seeking a judicial remedy (Article 12(3)–(4) GDPR).

Requests are dealt with free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, the Provider may charge a reasonable fee based on administrative costs or refuse to act on the request (Article 12(5) GDPR). If the Provider has doubts about the identity of the requester, it may request the additional information necessary to confirm their identity (Article 12(6) GDPR). Where a request is submitted electronically, the Provider responds electronically, unless otherwise requested.

13.1. Complaint to the NAIH

The Data Subject may lodge a complaint with the NAIH (Article 77 GDPR; Section 52(1) and Section 60(1)–(2) of the Infotv.), or with the supervisory authority of the Member State of their habitual residence, place of work or place of the alleged infringement. The NAIH's contact details are set out in the table below.

According to the NAIH, proceedings cannot be initiated by email; a submission requesting proceedings may be filed by post, through the online case initiation interface or through the official electronic gateway.

13.2. Judicial remedy

In the event of an infringement of their rights, the Data Subject may bring an action against the Provider as controller or – in the event of an infringement of the obligations of a processor – as processor (Section 23 of the Infotv.; Article 79 GDPR). The regional court (törvényszék) has competence to hear the action; at the Data Subject's choice, the action may also be brought before the regional court having jurisdiction for their place of residence or place of stay. The Provider bears the burden of proving that the processing is lawful. The Data Subject may also claim compensation under Article 82 GDPR and, in the event of an infringement of their personality rights, restitution for non-pecuniary damage (sérelemdíj) under Section 2:52 of the Ptk.

14.1. Age limit

The Service is not intended for persons under 18, and an Account may only be created by a person who has reached the age of 18. The Provider does not verify age. If it becomes aware that a person under 18 has created an Account, it closes the Account and deletes the person's data, except for the data it is required to retain by law.

14.2. Amendments to the Privacy Notice

The Provider publishes the Privacy Notice on the Website, indicating its version number and the date of its entry into force. If a new purpose of processing is introduced or the processing changes materially, the Provider also notifies Users by email before the change (Article 13(3) GDPR). The Provider keeps the earlier versions of the Privacy Notice and sends them on request.