Contact

Data protection

Privacy Policy

Effective: 9 October 2026

This is a translation. In case of any discrepancy, the Hungarian version prevails.

01Introduction

Borbás Bence, sole trader (the “Controller”), is committed to protecting personal data. This policy explains which personal data the Controller processes in connection with ziryvo.com and the ZIRYVO Studios services, for what purpose and on what legal basis, for how long, and what rights data subjects have.

It is based on Regulation (EU) 2016/679 (GDPR) and Hungarian Act CXII of 2011 on informational self-determination and freedom of information.

02The controller

Name
Borbás Bence, sole trader (egyéni vállalkozó)
Trading name
ZIRYVO Studios
Registered address
2045 Törökbálint, Alsóerdősor utca 35., Hungary
Postal address
2045 Törökbálint, Alsóerdősor utca 35., Hungary
Tax number
90924152-1-33
Registering authority
Ministry of the Interior — Register of Sole Traders (Hungary)
Phone
+36 70 595 2613
Website
ziryvo.com

The Controller is not required to appoint a data protection officer and has not done so. For data protection matters, contact bence@ziryvo.com.

03In short

  • This website uses no cookies, no analytics and no advertising tracking.
  • Fonts, images and videos are served from the website’s own hosting; no data is passed to third-party providers while you browse.
  • What you enter in the contact form is emailed to the Controller’s mailbox by the website’s own hosting (Hostinger); it is not stored on the hosting.
  • The Controller receives personal data only if you get in touch through the form, by email or by phone, or if a contract is concluded.

04Definitions

Personal data: any information relating to an identified or identifiable natural person.

Data subject: the natural person whose personal data is processed.

Controller: the person who determines the purposes and means of processing.

Processor: a person who processes personal data on behalf of and on the instructions of the controller.

05Processing activities

5.1. Enquiries and quotes (email, phone, contact form). Data: name, email address, phone number, company name, content of the message. Purpose: replying, preparing a quote, keeping in touch. Legal basis: steps taken at the data subject’s request prior to entering into a contract — Art. 6(1)(b) GDPR; and the Controller’s legitimate interest in business contact — Art. 6(1)(f) GDPR. Retention: if a contract is concluded, as under 5.2; otherwise 1 year from the last contact.

5.2. Client data. Data: name, registered address, tax number, company registration number, contact person’s name, position, email, phone, bank account number, contract details. Legal basis: performance of a contract — Art. 6(1)(b) GDPR; for contact persons, legitimate interest — Art. 6(1)(f) GDPR. Retention: 5 years from the end of the contract.

5.3. Invoicing and accounting. Legal basis: legal obligation — Art. 6(1)(c) GDPR, under section 169 of Hungarian Act C of 2000 on accounting. Retention: 8 years from the date of the accounting document; deletion cannot be requested before then.

5.4. Complaints. Legal basis: legal obligation — Art. 6(1)(c) GDPR, under section 17/A of Hungarian Act CLV of 1997 on consumer protection. Retention: 5 years from recording the complaint.

5.5. Visiting the website. To deliver the website, the hosting provider’s servers may log technical data (IP address, time of request, page viewed, browser and device type). Purpose: secure operation and prevention of abuse. Legal basis: the Controller’s legitimate interest — Art. 6(1)(f) GDPR. Retention: according to the hosting provider’s log retention practice. The Controller does not use this data to identify visitors.

5.6. Marketing. The Controller does not send newsletters. Any marketing communication would be sent only with prior, express consent — Art. 6(1)(a) GDPR — which may be withdrawn at any time free of charge.

06Processing on behalf of clients

6.1. When the Controller develops or operates a website for a client and in doing so accesses personal data of that client’s visitors or customers (e.g. form messages, data stored on hosting), it acts as a processor; the client determines the purposes and means of processing.

6.2. In this role the Controller processes data only on the client’s written instructions, keeps it confidential, applies appropriate technical and organisational measures, assists the client with data subject requests, notifies the client of any personal data breach without delay and at the latest within 24 hours, and at the end of the contract deletes or returns the data as the client decides. Where required, a data processing agreement under Article 28 GDPR is concluded.

6.3. In such cases data subjects should primarily contact the operator of the website concerned; any such request received by the Controller is forwarded to the client without delay.

07Processors and recipients

The Controller uses the following processors and categories of processors:

Hosting provider
Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus — operation of the website
Email and office services
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace) — correspondence, including messages sent through the contact form; document management
Accountant
bookkeeping

On request, the Controller provides written information on the name, address and activity of the processors used (bence@ziryvo.com). Beyond this, personal data is transferred only with the data subject’s consent or where required by law or by an authority or court.

08Transfers outside the EEA

8.1. The website’s hosting provider is a company registered in the European Union (Cyprus).

8.2. Where a provider used (e.g. for email or office services) processes data outside the European Economic Area, the Controller ensures the lawfulness of the transfer through a European Commission adequacy decision — including the EU–US Data Privacy Framework —, standard contractual clauses (SCC), or other appropriate safeguards under Chapter V GDPR. Information on the safeguards can be requested at bence@ziryvo.com.

09Security

9.1. Taking into account the state of the art, costs, and the nature and risks of processing, the Controller applies appropriate technical and organisational measures, in particular:

  • encrypted transmission (HTTPS/TLS) on the website;
  • strong, unique passwords and — where available — two-factor authentication on all provider accounts;
  • access restricted on a need-to-know basis;
  • regular backups;
  • encryption and password protection of work devices.

9.2. The Controller reports a personal data breach to the supervisory authority without undue delay and within 72 hours at the latest, unless it is unlikely to result in a risk. Where the risk is high, data subjects are also informed.

10Cookies and local storage

10.1. This website places no cookies on your device and uses no analytics, advertising or social media tracking code. For this reason no cookie consent banner is shown.

10.2. The website may use your browser’s local storage (localStorage, sessionStorage) solely for internal display settings; these contain no personal data and can be deleted in your browser settings at any time.

10.3. If this changes, the Controller will update this policy and will use any cookies that are not strictly necessary only with prior consent.

11Your rights

  • Access: you may ask whether the Controller processes your personal data and, if so, request a copy.
  • Rectification: you may request correction of inaccurate data or completion of incomplete data.
  • Erasure: you may request deletion of your data, in particular when it is no longer needed; erasure cannot be requested where processing is required by law (e.g. 8-year accounting retention).
  • Restriction: you may request restriction of processing, for example while the accuracy of the data is contested.
  • Portability: you may request data processed automatically on the basis of consent or contract in a structured, machine-readable format.
  • Objection: you may object to processing based on legitimate interest; objection to direct marketing is unconditional.
  • Withdrawal of consent: consent may be withdrawn at any time free of charge, without affecting the lawfulness of prior processing.

Requests can be sent to bence@ziryvo.com or to 2045 Törökbálint, Alsóerdősor utca 35., Hungary. The Controller responds without undue delay and within 1 month at the latest; this may be extended by 2 further months where justified, of which you will be informed within 1 month. Information is free of charge.

The Controller does not use decision-making based solely on automated processing, including profiling.

12Remedies

Complaint to the Controller: you may first send your complaint directly to bence@ziryvo.com.

Data protection authority. Complaints about data processing may be lodged with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9–11. Postal address: 1363 Budapest, Pf. 9. Phone: +36 (1) 391-1400. Email: ugyfelszolgalat@naih.hu. Website: naih.hu

Courts: if your rights are infringed you may go to court; proceedings may also be brought before the regional court of your place of residence or stay. Anyone who suffers damage as a result of unlawful processing is entitled to compensation, and in case of infringement of personality rights, to restitution.

13Changes to this policy

The Controller may amend this policy unilaterally, in particular in case of changes in law, guidance from authorities, or changes to the services or the website. The amended policy takes effect on publication on the website; clients are also informed of material changes by email.

14Applicable law

  • Regulation (EU) 2016/679 (GDPR);
  • Hungarian Act CXII of 2011 on informational self-determination and freedom of information;
  • Act CVIII of 2001 on electronic commerce;
  • Act C of 2003 on electronic communications;
  • Act C of 2000 on accounting;
  • Act CLV of 1997 on consumer protection;
  • Act V of 2013, the Civil Code.