Privacy policy

This is an English translation of the Hungarian original. In the event of any discrepancy, the Hungarian version prevails.

This notice concerns the processing of personal data in connection with the use of the digitalizalas.eu website (all language versions). It has been prepared in accordance with the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council), 2011. évi CXII. törvény (Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information, “Infotv.”), Section 155 of 2003. évi C. törvény (Act C of 2003 on Electronic Communications, “Eht.”), 2001. évi CVIII. törvény (Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services, “Ekertv.”), and Section 6 of 2008. évi XLVIII. törvény (Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities, “Grt.”). Details of cookies and data stored in the browser are set out in the Cookie policy.

In brief

• You do not need to provide any personal data to visit the site, and for a public visitor the site places no cookies.
• Visitor analytics (a measurement script running in the browser) starts only with your consent; if you decline, no measurement takes place.
• We process the data submitted via the contact form in order to provide a quote and to reply to your enquiry, for 24 months.
• We send a newsletter only after a separate, ticked consent and a double opt-in confirmed by e-mail.
• External content (YouTube, Vimeo, Google Maps, Sketchfab) is loaded only when you click; data may then be transferred outside the EU.
• We do not sell data, we do not pass it to advertising companies, and we carry out no profiling or automated decision-making.

1. The data controller

Name: Tripont Foto Video Kft.
Registered office: H-1131 Budapest, Reitter Ferenc u. 132/B
Tax number: 14247660-2-41
Company registration number: 01-09-895442
Representative: Balázs Dániel Peti
E-mail: info@digitalizalas.eu
Phone: +36 30 740 44 88

The controller has not appointed a data protection officer, because none of the mandatory cases under Article 37(1) GDPR applies. For data protection matters the controller can be reached at info@digitalizalas.eu.

2. Data processors and other recipients

The controller uses the service providers listed below. Data processors may process data solely on the controller’s instructions, on the basis of a data processing agreement under Article 28 GDPR, and may not use it for purposes of their own. We do not pass data to third parties for marketing or sales purposes.

• fixli.eu Kft. (1125 Budapest, György Aladár utca 27/D., tax number: 32820175-2-43, company registration number: 01-09-444326) – operation and development of the website, maintenance of the content management system and the servers, operation of the analytics and newsletter systems. Data processor.
• Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) – infrastructure for the servers (Falkenstein, Germany) and for data and backup storage (Helsinki, Finland), as a sub-processor of the data processor (fixli.eu Kft.). The data remain within the European Economic Area.
• Resend, Inc. (USA) – forwarding of the notification e-mails about enquiries received via the form, and of the confirmation and newsletter e-mails (e-mail sending service). The forwarding involves the content of the message and the recipient’s e-mail address; it constitutes a transfer of data to a third country (see section 4).
• Microsoft Ireland Operations Ltd. (Microsoft 365) – management of the info@digitalizalas.eu mailbox and of the correspondence conducted through it, in the controller’s own e-mail system.
• Cloudflare, Inc. (USA) – solely the name service (DNS) of the digitalizalas.eu domain. The traffic of the website does not pass through Cloudflare’s systems, and the provider does not see visitors’ page views.
• Anthropic, PBC (USA) – sub-processor of fixli.eu Kft., technical operation support: while the website is maintained and faults are fixed, the artificial-intelligence tools it uses (Claude) may see live data (for example received enquiries). The data are not used to train models. This constitutes a transfer to a third country (see section 4).
• The group’s external IT service provider (IT Hotline, contracted by Computer Emporium Kft.; Hungary/EU) – for business continuity, under its contract with the group, makes an office copy of the server backup with read-only access.

The analytics software (Plausible Analytics) and the newsletter software (Listmonk) are open source and run on a server in Germany operated by fixli.eu Kft.; the developers of the software do not gain access to the data. The website’s fonts and images are served from our own server and from the storage mentioned above, so when they are loaded the browser does not connect to Google or to any other external provider.

On a request from an authority, we disclose the data to the competent authority within the scope and under the conditions laid down by law.

3. The processing operations

3.1. Contact and quote requests (form, e-mail, telephone)

• Purpose: replying to incoming enquiries, providing quotes, keeping in touch.
• Data processed: name, e-mail address, (optionally) the name of the organisation, the type of project and the text of the message, as well as whatever you state in the message. On submission, the form also records the following related data sent by your browser: the language of the page, the path of the page opened (including query parameters), the web address of the page that led to the enquiry (the browser’s referrer data, without the query part and fragment, if the browser sends it), the campaign parameters in the page address (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the voluntary, optional answer to “How did you hear about us?”, and the version of the privacy notice in force at the time of submission. The form reads these data from the open page at the moment of submission, without storing anything on your device.
• Legal basis: for quote requests and steps preceding the conclusion of a contract, processing that is necessary at your request (Article 6(1)(b) GDPR); for replying to other enquiries, and for processing the related data (language, page, referrer, campaign parameters, self-reported source), the controller’s legitimate interests (Article 6(1)(f)): routing the enquiry correctly and understanding which content and channels lead to enquiries. You may object to processing based on legitimate interests (see section 7).
• Providing the data is voluntary; however, without your name, e-mail address and message the enquiry cannot be answered.
• Storage and recipients: we save the submitted enquiry in the content management system’s database (before the notification e-mail is sent) and send a notification e-mail to info@digitalizalas.eu (Resend, Microsoft 365). The controller’s authorised staff and users logged in to the content management system have access to the enquiries; public (anonymous) retrieval is not possible. For enquiries made directly by e-mail or telephone, the same purposes, legal bases and retention periods apply.
• Retention: 24 months from submission, after which we delete the data from the database and the mailbox. If the enquiry results in a contract, we process the data related to the contract according to the applicable statutory obligations (e.g. 8 years for accounting documents) and the limitation period for claims.

3.2. Protection against automated abuse (spam)

• Purpose: protecting the form and the server against mass, automated submissions.
• Data processed: the content of a hidden honeypot field, a signed timestamp generated when the form is displayed (it identifies no one), and the submitter’s IP address and e-mail address in a submission counter kept in the server’s memory (by IP address for 10 minutes, by e-mail address for 1 hour; it is not written to a database or log). Submissions suspected of being spam are flagged and saved (they are not sent to the mailbox) so that false positives can be corrected.
• Legal basis: the controller’s legitimate interests in operating the website securely (Article 6(1)(f) GDPR).
• Retention: 30 days for submissions flagged as suspected spam; for the counter kept in memory, 1 hour at most (it is cleared on restart).

3.3. Newsletter (with double opt-in)

• Purpose: sending news and newsletters about Tripont’s cultural heritage digitisation activities.
• How: it can be requested on the contact form by means of a separate checkbox that is not pre-ticked. Subscription becomes valid only once you click the confirmation link sent by e-mail (double consent, double opt-in); until then we send no newsletter.
• Data processed: name, e-mail address; to evidence the consent: the time of the consent, the exact text of the checkbox (as you saw it), the version of the notice in force at the time, the status of the confirmation e-mail, and the IP address and time recorded by the newsletter system at confirmation. For newsletters, aggregate (not individual-level) statistics of opens and clicks are produced; we do not track the opens and clicks of individual recipients.
• Legal basis: your explicit, prior consent (Article 6(1)(a) GDPR; Section 6 of the Grt.). Consent may be withdrawn at any time without giving reasons: every newsletter contains an unsubscribe link, and withdrawal can also be requested at info@digitalizalas.eu. Withdrawal does not affect the lawfulness of processing carried out before it. Subscribing to the newsletter is not a condition for answering an enquiry.
• Recipients: the newsletter system (Listmonk, operated by fixli.eu Kft., Hetzner, Germany) and, for sending the e-mails, Resend, Inc. (USA).
• Retention: until unsubscription. An unconfirmed subscription is deleted after 30 days. After unsubscription, the e-mail address is kept solely to prevent further sending; erasure (permanent removal of the data) can also be requested on the newsletter system’s preferences page, as well as at info@digitalizalas.eu. The evidence of consent (time, text, version) is stored together with the enquiry, for the retention period applicable to it.

3.4. Anonymous enquiry counting (server-side)

• Purpose: measuring the actual number of enquiries received, including from those who declined browser-based measurement.
• How: after an accepted enquiry, our server sends a counting event to our own Plausible system. It does not access your device, reads nothing from it, places no cookie, and does not forward your IP address (the system sees only the address of our own server).
• Data transmitted: the name of the event (“Ajánlatkérés (szerver)”, i.e. “Quote request (server)”), the language of the page, the self-reported source (if you provided it), and the path of the page without the query part. Your name, e-mail address, message or any other identifier are not included. Submissions suspected of being spam are not counted.
• Legal basis: the controller’s legitimate interests (Article 6(1)(f) GDPR) in knowing the number of enquiries accurately. Because the data do not identify a natural person and the device is not accessed, consent under Section 155(4) of the Eht. is not required.
• Retention: 24 months (the general retention period of the analytics system).

3.5. Visitor analytics (with consent)

• Purpose: measuring visits to and use of the website, improving its content and functioning.
• How: on your first visit a bar appears at the bottom of the page with two equally weighted buttons (“Accept”, “Decline”). The measurement script is loaded only after you click “Accept”; until then, and if you decline or close the bar, the browser sends no request to the analytics system. The measurement uses no cookies.
• Legal basis: the visitor’s consent (Article 6(1)(a) GDPR; Section 155(4) of the Eht. – a measurement script running in the browser counts as access to the device, even without cookies; see EDPB Guidelines 2/2023). Consent can be withdrawn at any time via the “Cookie and analytics settings” link in the footer; withdrawal does not affect the lawfulness of measurement carried out before it, and from the next page load the measurement script is no longer loaded.
• Data processed: the address of the page viewed, the referring page (where you came from) and the campaign parameters in the address, the type of browser and operating system, the type of device (mobile/desktop), the screen size, the country, region and town (derived from the IP address; we do not store the IP address), and the actions you perform: clicks on telephone numbers and e-mail addresses, the quote request buttons and form submission, downloads and outbound links, scrolling to 75% of the page, and opening non-existent pages. To count unique visitors, a non-reversible code that changes daily is generated (IP address + browser + domain + daily secret), which from the next day makes it impossible to recognise the same visitor. The browsers of the site’s staff are excluded from measurement.
• Tool and data processor: Plausible Analytics (open source), on fixli.eu Kft.’s own server in Germany (Hetzner, Falkenstein) (analytics.fixli.eu); we do not pass the data to third parties, do not use it for advertising, and the software’s developer has no access.
• Retention: 24 months. Your decision (acceptance or refusal) is kept by the browser’s local storage (fixli-consent) for 12 months; storing it is strictly necessary for managing consent, so no separate consent is required for it. After 12 months we ask again.

3.6. External content (YouTube, Vimeo, Google Maps, Sketchfab) – on click

• How: the videos, the 3D models and the map on the contact page are not loaded when the page is opened; an information panel is shown instead. Until you click, no request is sent to the providers and nothing is stored on your device.
• What happens when you click: your browser connects directly to the provider: YouTube (Google Ireland Limited / Google LLC; youtube-nocookie.com), Vimeo (Vimeo.com, Inc., USA; player.vimeo.com, with a “do not track” request), Google Maps (Google Ireland Limited / Google LLC), Sketchfab (Sketchfab / Epic Games group). The provider receives your IP address, your browser data, the address of the page opened (as referrer) and your actions related to the display; the player may place a cookie or local storage, and if you are logged in to the service concerned, it may identify you.
• Legal basis: your consent (Article 6(1)(a) GDPR; Section 155(4) of the Eht.), which you give by clicking the load button after reading the information shown before it. Section 4 applies to the transfer. Without consent the content is not displayed; the rest of the site can be used. The providers process the data as independent controllers; their own notices govern: Google, Vimeo, Sketchfab.
• Records: the controller keeps no records of the fact of loading or of playback data.

3.7. Technical operation of the website, security, backups

• Purpose: serving the site, operating it securely and without errors, data backup.
• Data processed: when the page is opened, the technical data of the connection (IP address, browser, requested address) are processed on the server for the duration of serving it. The controller keeps no access log of visits. The server’s application log records errors (in the event of an error, the contact e-mail address may also appear in it); the log is rotating and size-limited (3 × 10 MB), is deleted when the application is redeployed, and is otherwise kept for 90 days at most. Backups serve only to restore the service after a failure or incident, are encrypted, are not used for any other purpose, and are accessible to the processor’s operators and, with read-only rights and solely to make the office copy, to the group’s IT service provider. The database is backed up daily: a local copy on the server for 30 days, and an encrypted offsite copy in Hetzner’s object storage in Finland (Helsinki) with versioning and a 30-day object lock; Hetzner also takes a daily snapshot of the server (7 rolling copies). Data deleted from the live system disappear from the local copies within 30 days and from the offsite copies when these are rotated; if a backup ever has to be restored, the deletions and retention periods are re-applied before it goes live. The retention of backups is reviewed periodically.
• Legal basis: the controller’s legitimate interests (Article 6(1)(f) GDPR) in the security of the website and in protection against loss of its data.
• DNS: the domain’s name service is provided by Cloudflare, Inc.; this concerns the technical data of name resolution, and the traffic of the website does not pass through it.

3.8. Users of the content management system (editors)

• Purpose: editing the website’s content, protecting access and tracking changes.
• Data processed: the editor’s name, e-mail address, the hashed form of their password, role (editor, approver, administrator), and the fact and time of logins and edits. A logged-in session uses a session cookie (see the Cookie policy).
• Legal basis: the controller’s legitimate interests (Article 6(1)(f) GDPR) in managing content securely and controlling access. The data do not appear on the public site.
• Retention: for as long as the access exists; when it ends, we delete the account.

4. Transfers of data to third countries

The website’s servers and storage operate within the European Economic Area (Germany, Finland). Data may reach a third country (outside the EEA, mainly the United States) in the following cases:

• Notification and newsletter e-mails (Resend, Inc., USA): the data processing agreement contains the European Commission’s standard contractual clauses (Article 46(2)(c) GDPR) and appropriate safeguards.
• Name and DNS service (Cloudflare, Inc., USA): the technical data of name resolution requests; the provider acts under the EU–US Data Privacy Framework.
• Development and operations support (Anthropic, PBC, USA): may see live data during maintenance; the transfer is based on the standard contractual clauses (Article 46(2)(c) GDPR) forming part of the processing agreement (Anthropic’s data processing addendum and commercial terms); the data are not used to train models.
• External content (Google, Vimeo, Sketchfab): only if you click the load button; your browser sends the data directly to the provider. Transfer to the USA is based on the European Commission’s adequacy decision (EU–US Data Privacy Framework, if the provider has joined it) or on standard contractual clauses; failing that, on your explicit, informed consent (Article 49(1)(a) GDPR). The US authorities may have access to the data; if you do not accept this, do not click to load.

You can request a copy of the safeguards at info@digitalizalas.eu.

5. Retention periods in summary

• Enquiries (form, e-mail): 24 months; submissions suspected of being spam: 30 days.
• Newsletter: until unsubscription; unconfirmed subscription: 30 days.
• Anonymous enquiry counter and browser-based visitor analytics: 24 months.
• Analytics decision in the browser: 12 months.
• Application log: 90 days at most; backups: see section 3.7.
• Editor accounts: for as long as the access exists.

6. Data security

The site and the analytics system are accessible over an encrypted (HTTPS) connection. Enquiries can be read only by logged-in users and cannot be queried publicly; access is tied to roles, and passwords are stored only in hashed form. Backups are encrypted. The controller has taken the necessary technical and organisational measures and, in the event of a personal data breach, acts in accordance with Articles 33–34 GDPR.

7. Rights of the data subject

Under the GDPR you may exercise the following rights:

• Right of access (Article 15): you may request information about, and a copy of, the data we process about you.
• Right to rectification (Article 16): you may request the correction of inaccurate data.
• Right to erasure (Article 17): you may request the erasure of your data where the conditions set out in that article are met.
• Right to restriction of processing (Article 18): you may request that processing be restricted.
• Right to data portability (Article 20): you may request your data processed on the basis of consent or contract in a machine-readable format.
• Right to object (Article 21): you may object, giving reasons, to processing based on legitimate interests; in that case we no longer process the data, unless we have compelling legitimate grounds.
• Right to withdraw consent (Article 7(3)): processing based on consent (newsletter, browser-based analytics, external content) may be ended at any time; withdrawal does not affect the lawfulness of processing carried out before it.

You can send your request to info@digitalizalas.eu. We inform you of the action taken on the request at the latest within one month; where necessary, given the complexity and number of requests, this period may be extended by a further two months, of which we will inform you within the first month. Information and action are free of charge. If we are unable to establish your identity, we may request further information.

We carry out no automated decision-making or profiling (Article 22 GDPR).

8. Remedies

If you consider that the processing of your data infringes the GDPR, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) (Section 52 of the Infotv.) or – under Sections 22–23 of the Infotv. – bring the matter before a court; at your choice, the action may also be brought before the regional court (törvényszék) for your place of residence or place of stay. To resolve your complaint, we recommend that you first contact the controller.

• Registered office: 1055 Budapest, Falk Miksa utca 9–11.
• Postal address: 1363 Budapest, Pf. 9.
• Phone: +36 1 391 1400
• E-mail: ugyfelszolgalat@naih.hu
• Web: naih.hu

As a resident of another Member State, you may also lodge a complaint with the supervisory authority of your place of residence.

9. Changes to this notice

We publish the version of this notice in force at any given time on this page, together with the version number and the date of the latest update. Earlier versions are available on request. If an amendment introduces new processing or a new recipient, we publish it before it takes effect and, for processing based on consent, request new consent where necessary. The version number of the notice in force at the time of submission is recorded together with the enquiry.