Privacy policy

btothbalazs.hu
Effective from 21 October 2026

This policy explains what personal data I process on btothbalazs.hu (the Hungarian and English pages, the project questionnaire and the Snake game), why, for how long, and what rights you have. Processing follows the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Hungarian Act CXII of 2011 on informational self-determination.

1. Data controller

• Name: LÉNOSZ-KER Korlátolt Felelősségű Társaság (LÉNOSZ-KER Kft.)
• Registered office: Kossuth utca 6., 5538 Biharugra, Hungary
• Company registration number: 04-09-15310 (Registry Court of Gyula)
• Tax number: 27928789-2-04 (EU VAT: HU27928789)
• Contact person: Balázs Tóth (B. Tóth Balázs)
• Email: hello@btothbalazs.hu

Where this policy says "I" ("I process", "I store"), it means the data controller, LÉNOSZ-KER Kft., and its contact person acting on its behalf, Balázs Tóth.

I have not appointed a data protection officer, as the law does not require one. For any question about your data, write to the email address above.

2. What data I process, why and for how long

2.1. Contact form

Your message arrives by email and is also stored in the website's database.

2.2. Project questionnaire (btothbalazs.hu/igenyfelmero, btothbalazs.hu/en/questionnaire)

While you fill it in, your answers are also saved in your own browser (localStorage) so you can continue later. This never reaches me and is deleted after a successful submission. Uploaded files are stored on the website's hosting at a random, non-searchable address.

After submitting, you receive an automatic confirmation email with a short summary of your answers.

Please don't upload files containing other people's personal data unless you're entitled to (for example, photos of other people without their consent).

2.3. Snake game (btothbalazs.hu/en/snake)

The leaderboard is public, so please don't use your full name. Only the best results (up to 100) are kept.

2.4. Outgoing email log

The website keeps a log of the emails it sends (for example the confirmation and the notifications I receive): recipient, subject, content, time and delivery result.

• Purpose: checking delivery, troubleshooting
• Legal basis: my legitimate interest [GDPR Art. 6(1)(f)]
• Retention: 30 days

2.5. If a contract follows

Data needed to carry out the work (contact details, project materials, correspondence) is processed to perform the contract [GDPR Art. 6(1)(b)] for 5 years after the contract ends (the general limitation period under the Hungarian Civil Code). Invoicing data is kept for 8 years under Section 169 of Hungarian Act C of 2000 on Accounting [GDPR Art. 6(1)(c)].

2.6. Hosting and server logs

The hosting provider keeps technical logs for operation and security (IP address, time of request, page opened, browser type).

• Legal basis: legitimate interest: secure operation of the website [GDPR Art. 6(1)(f)]
• Retention: according to the hosting provider's rules

3. Cookies and third-party content

When you first open the site, a cookie banner lets you decide which cookies you accept. You can change your choice at any time with the cookie settings icon in the corner of the screen.

• Necessary cookies: needed to remember your cookie choice and for the site to work. Legal basis: legitimate interest [GDPR Art. 6(1)(f)].
• Statistics and marketing cookies: the site runs Google Tag Manager, through which analytics and advertising tags (such as Google Analytics) may run. They only store cookies or identifiers if you consent in the cookie banner; until then, under Google Consent Mode, they send at most cookieless, aggregated signals. Their purpose is to measure and improve the site's traffic. Legal basis: consent [GDPR Art. 6(1)(a)]. Retention: up to 14 months depending on the cookie, or until you withdraw consent.
• Third-party content: the site loads content from other providers. They may receive your IP address and set their own cookies:
• Google Tag Manager and the Google services running through it (Google Ireland Ltd.)
• Google Fonts (fonts, Google Ireland Ltd.)
• Facebook videos in the Video & social section (Meta Platforms Ireland Ltd.)
• YouTube videos in privacy-enhanced mode (youtube-nocookie.com, Google Ireland Ltd.)
• Elementor services, such as the cookie banner and the accessibility tool (Elementor Ltd.)

Their own privacy policies apply to this processing.

If I add a new analytics or advertising service, I'll update this policy and only enable it with your consent.

4. Who has access to the data (processors)

I don't sell your data or pass it on to third parties for marketing. To run the website I use the following providers:

If a contract follows and another professional is needed for the work (for example a subcontractor), I only share the data they need, and I'll tell you in advance.

Transfers outside the EU

The parent companies of Google and Meta are based in the United States, so some data may reach the US. This happens under the EU–US Data Privacy Framework, on the basis of an adequacy decision. For Israel, the European Commission's adequacy decision ensures the protection of your data. Data reaching Anthropic's US parent company may be transferred with the safeguards required by Chapter V of the GDPR (such as the European Commission's standard contractual clauses).

5. Security

Data is stored in a password-protected system accessible over an encrypted (HTTPS) connection. Only I have access to it, along with the processors listed in section 4, to the extent their role requires. Uploaded files sit at random, unguessable addresses, and folder contents can't be listed. I keep the website's software up to date.

6. Your rights

While your data is being processed, you can ask at any time for:

• Access: information about what data I hold about you, and a copy of it (GDPR Art. 15).
• Rectification: correction of inaccurate data (Art. 16).
• Erasure: deletion of your data when it's no longer needed or you withdraw your consent (Art. 17).
• Restriction: that your data temporarily not be used (Art. 18).
• Portability: the data you provided, in a machine-readable format (Art. 20).
• Objection: to processing based on legitimate interest (Art. 21).
• Withdrawing consent: at any time, without giving a reason. This doesn't affect the lawfulness of processing before the withdrawal.

Send your request to hello@btothbalazs.hu. I'll reply within one month; if the request is complex, I may extend this once by two months and will let you know.

7. Remedies

If you feel your data protection rights have been violated, please write to me first so we can sort it out. You can also lodge a complaint with the Hungarian supervisory authority, or with the data protection authority of the EU country where you live or work:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Falk Miksa utca 9–11., 1055 Budapest, Hungary
Postal address: 1363 Budapest, Pf. 9.
Email: ugyfelszolgalat@naih.hu
Web: naih.hu

You can also go to court.

8. Changes

I may update this policy, for example when I add a new service to the website. The current version is always available on this page, with its effective date.