1. General information
The Data Controller operates the website available at https://motivumwebstudio.hu/ (hereinafter: the Website). This notice is intended for natural persons whose personal data we process in connection with the use of the Website and of the forms available on it, for the purposes detailed below (hereinafter: data subjects).
In processing personal data, the Data Controller complies with the applicable legislation, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: GDPR or General Data Protection Regulation), Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (hereinafter: Infotv.) and other applicable laws. Terms used in this notice have the meanings defined in the GDPR and the Infotv.
Through this notice, the Data Controller fulfils its information obligations under Articles 13 and 14 of the GDPR.
The Data Processing and Data Protection Policy – which also applies to you – covers all questions related to data processing in full detail.
If you have any questions about this notice or your rights, you can request further information using our contact details.
Name: DP Consult Kft.
Registered office: 4025 Debrecen, Antall József utca 3., Hungary
Tax number: 14374812-2-09
Email: info@motivumwebstudio.hu
If you have any questions, complaints or comments about this notice or the Data Controller’s data processing, you can contact us at:
Postal address: 4025 Debrecen, Antall József utca 3., Hungary
Email: info@motivumwebstudio.hu
2. Description of data processing on our Website, by purpose
| Purpose of processing | Data subjects | Data processed | Legal basis | Retention period |
|---|---|---|---|---|
| Contact and communication via the phone number, email address and postal address given on the Website. | Data subjects who contact the Company via the phone number, email or postal address given on the Website. | The data subject’s name, phone number, email address and any other data or information they provide. | Article 6(1)(a) of the General Data Protection Regulation (GDPR) [the data subject’s voluntary consent]. | Until the data subject withdraws consent, but no later than 2 years after the last contact. |
| Contact via the message (contact) forms available on the Website (at the bottom of the pages, in the contact panel and on the Contact page), and replying to enquiries. | Data subjects who fill in the contact forms available on the Website. | Name (first and last name), email address, phone number (optional), the name and address of the business or current website, the subject of the enquiry, the planned start date, the content of the message, and how they heard about the Data Controller. | Article 6(1)(b) GDPR [taking steps at the request of the data subject prior to entering into a contract]; for any additional data provided voluntarily, Article 6(1)(a) GDPR [the data subject’s consent]. | Without a contract, 1 year after the last contact; if a contract is concluded, until the contract ends or for the retention period required by accounting laws. |
| Completing the website questionnaire and preparing a personalised quote or suggestion. | Data subjects who fill in the website questionnaire available on the Website. | Name, email address, phone number (optional), the answers given in the questionnaire (the business’s activity, existing website, type and features of the planned website, project status, planned deadline and budget, preferred next step), the content of any note, and the fact that the privacy notice was accepted. | Article 6(1)(b) GDPR [taking steps at the request of the data subject prior to entering into a contract]. | Without a contract, 1 year after the last contact; if a contract is concluded, until the contract ends or for the retention period required by accounting laws. |
| Booking a free online consultation (Cal.com booking system) and holding the online conversation (Google Meet). | Data subjects who book an appointment on the Website. | Name, email address, the chosen time slot, any note given when booking, and the details of the online meeting invitation. The conversation is not recorded. | Article 6(1)(b) GDPR [taking steps at the request of the data subject prior to entering into a contract]. | 1 year after the appointment, or until the contract ends if a contract is concluded. |
| Supporting the operation of the Website and visits to it. Cookies: detailed information is available in the Website’s Cookie policy . | Visitors to the Website. | Data collected by the cookies used on the Website. | For non-essential cookies, Article 6(1)(a) GDPR [the data subject’s voluntary consent]; for essential (strictly necessary) cookies, Article 6(1)(f) GDPR [the Data Controller’s legitimate interest in the proper operation of the Website]. | According to the lifetime of each cookie as set out in the Cookie policy; for consent-based cookies, until consent is withdrawn. |
| Making backups to ensure the integrity and recoverability of data. | Visitors to the Website and data subjects. | Backups of data processed in connection with the operation and use of the Website. | Article 6(1)(f) GDPR [the Data Controller’s legitimate interest in ensuring that data is preserved and recoverable and that operations continue]. The data subject has the right to object to processing based on legitimate interest. | According to the backup system settings, no more than 30 days after the backup is made; after that, backups are overwritten or deleted. |
| Ensuring the secure operation of the Website and detecting abuse and attacks (hosting provider server logs). | Visitors to the Website. | IP address, time of visit, address of the page viewed, browser and operating system type. | Article 6(1)(f) GDPR [the Data Controller’s legitimate interest in the secure operation of the Website]. The data subject has the right to object to processing based on legitimate interest. | According to the hosting provider’s logging settings, typically no more than 90 days. |
Cookies:
Detailed information is available in the Website’s Cookie policy .
Ways to withdraw consent to data processing: electronically via the info@motivumwebstudio.hu email address or through the messaging (form) interface available on the Website, by sending a message requesting unsubscription; by post, by sending a statement requesting unsubscription to the Data Controller.
Users can delete cookies from their own device or disable the use of cookies in their browser. Cookies can usually be managed in the browser’s Tools/Settings menu under Privacy/History/Custom settings, labelled cookies or tracking. More information is available in the relevant menu of the browser you use, or can be requested from the Data Controller.
3. Method and security of data processing
The Data Controller processes data by recording it with the external service providers it uses and in its own records and software, and by storing it on its servers or in the cloud provided by the hosting provider. Otherwise, the Data Controller records personal data electronically or on paper.
The Data Controller treats personal data confidentially and takes all necessary IT, technical and organisational measures relating to data storage and processing that support secure data handling.
Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Data Controller implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
The Data Controller selects and operates the IT tools used to process personal data in the course of providing the service so that the processed data is:
a) accessible to those authorised to access it (availability);
b) authentic and authenticated (authenticity of processing);
c) verifiably unchanged (data integrity);
d) protected against unauthorised access (data confidentiality)
.
The Data Controller protects data with appropriate measures, in particular against unauthorised access, alteration, transfer, disclosure, deletion or destruction, as well as accidental destruction, damage, and loss of access resulting from changes in the technology used.
To protect the data sets processed electronically in its various records, the Data Controller uses appropriate technical solutions to ensure that stored data cannot be directly linked and attributed to the data subject, unless permitted by law.
Taking into account the state of technology at any given time, the Data Controller ensures the security of processing through technical, organisational and structural measures that provide a level of protection appropriate to the risks involved in the processing.
In the course of processing, the Data Controller maintains
a) confidentiality: it protects information so that only those authorised can access it;
b) integrity: it protects the accuracy and completeness of the information and the processing method;
c) availability: it ensures that authorised users can actually access the required information, and the related tools, whenever they need them.
The Data Controller’s IT system and network are protected against computer-assisted fraud, espionage, sabotage, vandalism, fire and flood, as well as computer viruses, intrusions and denial-of-service attacks. The operator ensures security through server-level and application-level protection procedures.
Please note that electronic messages transmitted over the internet, regardless of protocol (email, web, ftp, etc.), are vulnerable to network threats that may lead to dishonest activity, disputes over contracts, or the disclosure or modification of information. The provider takes all reasonable precautions to protect against such threats. It monitors its systems in order to record any security anomalies and provide evidence in the event of any security incident. System monitoring also makes it possible to check the effectiveness of the precautions taken.
4. Automated decision-making and profiling
No automated decision-making or profiling takes place in the course of processing.
5. Who may we share your personal data with?
| Recipient name and registered office | Recipient’s legal status | Reason for transfer / activity |
|---|---|---|
| Rackhost Zrt. (6722 Szeged, Tisza Lajos körút 41., Hungary; company registration number: 06-10-000489) | data processor | Performs data processing related to web hosting (storage of the Website, data submitted via forms and server logs). |
| Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) | data processor | Provides Google Workspace services: correspondence between the Data Controller and data subjects (Gmail), recording booked appointments in the calendar (Google Calendar) and holding online conversations (Google Meet). |
| Cal.com, Inc. (2261 Market Street #4382, San Francisco, CA 94114, United States) | data processor | Provides the online booking system (Cal.com). |
Besides the recipients above, the Data Controller may transfer personal data to other persons if the transfer is required by law or by an order of an authority or court.
Data processor recipients may process the data subject’s personal data only for the purposes we define and set out in a contract, and according to our instructions; they have no independent decision-making power over the processing. Our data processors undertake confidentiality obligations and contractual guarantees regarding the personal data they learn while performing their tasks.
Recipients acting as independent data controllers, as third parties, determine the purposes and means of processing personal data themselves, in accordance with the rules applicable to them, with independent decision-making power over the processing.
6. Transfer of personal data to a third country or international organisation
Because of the Google and Cal.com services listed in section 5, personal data may also be transferred outside the European Economic Area, to the United States. Such transfers are based on the European Commission’s adequacy decision (EU–US Data Privacy Framework) or on the Standard Contractual Clauses adopted by the European Commission. The Data Controller does not transfer personal data to international organisations.
7. Your rights in relation to data processing
In this section we summarise, concisely, transparently and clearly, the rights you have as a data subject in relation to the Data Controller’s processing. You can request further information about exercising these rights using the contact details above.
7.1 RIGHT TO PRIOR INFORMATION
The data subject has the right to be informed of the facts and information related to the processing before the processing begins (Articles 13–14 GDPR).
7.2 RIGHT OF ACCESS BY THE DATA SUBJECT
The data subject has the right to obtain confirmation from the Data Controller as to whether or not their personal data are being processed and, where that is the case, access to the personal data and the related information defined in the GDPR (Article 15 GDPR).
7.3 RIGHT TO RECTIFICATION
The data subject has the right to have the Data Controller rectify inaccurate personal data concerning them without undue delay. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of a supplementary statement (Article 16 GDPR).
7.4 RIGHT TO ERASURE (“RIGHT TO BE FORGOTTEN”)
The data subject has the right to have the Data Controller erase personal data concerning them without undue delay, and the Data Controller is obliged to erase such data without undue delay where one of the grounds set out in the GDPR applies (Article 17 GDPR).
7.5 RIGHT TO RESTRICTION OF PROCESSING
The data subject has the right to have the Data Controller restrict processing where the conditions set out in the GDPR are met (Article 18 GDPR).
7.6 NOTIFICATION OBLIGATION REGARDING RECTIFICATION OR ERASURE OF PERSONAL DATA OR RESTRICTION OF PROCESSING
The Data Controller informs every recipient to whom the personal data have been disclosed of any rectification, erasure or restriction of processing, unless this proves impossible or involves disproportionate effort. At the data subject’s request, the Data Controller informs them about those recipients (Article 19 GDPR).
7.7 RIGHT TO DATA PORTABILITY
Under the conditions set out in the GDPR, the data subject has the right to receive the personal data concerning them, which they have provided to the Data Controller, in a structured, commonly used and machine-readable format, and has the right to transmit those data to another controller without hindrance from the Data Controller (Article 20 GDPR).
7.8 RIGHT TO OBJECT
The data subject has the right to object at any time, on grounds relating to their particular situation, to processing of their personal data based on Article 6(1)(e) GDPR (processing necessary for a task carried out in the public interest or in the exercise of official authority vested in the Data Controller) or Article 6(1)(f) (processing necessary for the legitimate interests of the Data Controller or a third party) (Article 21 GDPR).
7.9 AUTOMATED INDIVIDUAL DECISION-MAKING, INCLUDING PROFILING
The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them (Article 22 GDPR).
7.10 RESTRICTIONS
Union or Member State law to which the Data Controller or processor is subject may restrict, by way of a legislative measure, the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34 GDPR, insofar as its provisions correspond to the rights and obligations provided for in Articles 12 to 22 (Article 23 GDPR).
7.11 COMMUNICATION OF A PERSONAL DATA BREACH TO THE DATA SUBJECT
Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the Data Controller communicates the personal data breach to the data subject without undue delay (Article 34 GDPR).
8. How to exercise your rights
The data subject has the right to lodge a complaint with a supervisory authority – in particular in the Member State of their habitual residence, place of work or place of the alleged infringement – if they consider that the processing of personal data relating to them infringes the GDPR (Article 77 GDPR).
Every natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them, or where the supervisory authority does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged (Article 78 GDPR).
Every data subject has the right to an effective judicial remedy where they consider that their rights under the GDPR have been infringed as a result of the processing of their personal data in non-compliance with the GDPR (Article 79 GDPR; section 23 of the Infotv.).
Supervisory authority contact details:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Postal address: 1363 Budapest, Pf. 9., Hungary
Address: 1055 Budapest, Falk Miksa utca 9–11, Hungary
Phone: +36 (1) 391-1400
Fax: +36 (1) 391-1410
Email: ugyfelszolgalat@naih.hu
URL: http://naih.hu
DP Consult Kft.
Data Controller
2026. ………..