Privacy Policy

The data controller responsible for processing your personal data on this website is:

This website is hosted on Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). Vercel processes the technical data necessary to deliver the website to your browser.

Vercel automatically records standard server logs containing your IP address, user agent, requested URL, HTTP method, response status, and timestamp. These logs are used exclusively for security, abuse prevention, and debugging. Logs are retained for a maximum of 30 days and then deleted.

Personal data is transferred to the United States under Vercel's Data Processing Addendum, which incorporates the EU Standard Contractual Clauses (SCCs) approved by the European Commission. Where available, we deploy to Vercel's EU regions to minimise cross-border transfers.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in providing a functional, secure website.

We use Umami, an open-source, privacy-focused analytics tool. Our Umami instance is self-hosted on a private server located in Hungary (within the EU). No data is transferred outside the EU.

Umami does not use cookies, does not track you across websites, does not collect personally identifiable information, and does not store your IP address. All measurements are aggregated and anonymous (page views, referrers, screen sizes, browser families).

We have performed a Legitimate Interest Assessment and concluded that anonymous, cookie-free, self-hosted analytics with no cross-site tracking represents a minimal privacy impact and is necessary to understand which content is useful to visitors. The assessment is available on request.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in understanding website usage without compromising user privacy.

When you submit the contact form, we process the name, email address, and message you provide in order to respond to your inquiry. The form data is transmitted via Resend Inc. (a US-based email delivery service) to deliver the inquiry to us and a confirmation receipt back to you.

Your data is not stored in any database. The submission is converted directly into an email and discarded from server memory. Resend processes the data under their Data Processing Addendum, which incorporates SCCs.

Retention: inquiry emails are kept in our mailbox for up to 12 months for follow-up purposes and then deleted. If your inquiry leads to a contractual relationship, the related correspondence is retained for 8 years to comply with Hungarian accounting law (Act C of 2000, §169).

Legal basis: Art. 6(1)(b) GDPR — processing necessary to respond to your pre-contractual inquiry; Art. 6(1)(c) GDPR — compliance with statutory accounting retention obligations.

We offer optional online booking via Cal.com (Cal.com Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA). Cal.com is hosted in the EU on cal.eu and may receive technical data such as your IP address, browser, and selected booking slot.

The Cal.com widget is gated behind explicit consent — it does not load and does not transmit any data until you click 'Load calendar' on the contact section. Your consent choice is remembered in your browser's localStorage so you don't have to repeat it on subsequent visits. You can revoke it any time by clearing your browser data for this site.

Legal basis: Art. 6(1)(a) GDPR — your explicit consent before any data transfer to Cal.com.

This website uses only strictly necessary first-party storage for: language preference, theme preference (light/dark), Cookiebot consent record, and the Cal.com embed consent flag. No tracking, advertising, or profiling cookies are used.

Cookie consent is managed by Cookiebot (Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark — EU). Cookiebot stores an anonymous consent record on your device and a copy on Cybot's servers in the EU for legal proof of consent.

You can review or withdraw your cookie consent at any time by clicking the small cookie icon in the bottom-left corner of any page on this website. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Cookies in use

The full list of cookies is loaded by Cookiebot below.

We rely on the following sub-processors. Each has a Data Processing Addendum in place and, where applicable, transfers data under EU Standard Contractual Clauses.

We do not sell, rent, trade, or otherwise share your personal data with third parties for marketing, advertising, profiling, or any commercial purposes.

Data is only shared with the sub-processors listed above and only to the extent strictly necessary for operating this website.

Under the GDPR (Articles 15–22) you have the following rights at any time:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion of your data.
• Restriction — request that processing be limited.
• Data portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interest.
• Withdraw consent — for any processing based on consent (such as the Cal.com embed) without affecting the lawfulness of processing prior to withdrawal.
• Lodge a complaint with a supervisory authority (see section 11).

To exercise any of these rights, contact us at business@zsoltboda.com. We may ask you to verify your identity before disclosing personal data.

We respond to verified requests within 30 days as required by Art. 12(3) GDPR. For complex or numerous requests we may extend this period by up to two further months and will notify you of any such extension within the first month.

This website is intended for a professional adult audience. We do not direct our services to children under the age of 16 and do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us so we can delete it.

You have the right to lodge a complaint with a data protection supervisory authority — particularly the one in the EU member state where you live, work, or where the alleged infringement took place.

The competent supervisory authority for our processing is:

We may update this privacy policy from time to time to reflect changes to our processing activities or to applicable law. Material changes will be highlighted on this page and the "last updated" date at the top will be revised accordingly. We encourage you to review this page periodically.