Effective from: January 1, 2026. This document is a draft — legal review is recommended before finalization. Last updated: October 29, 2026.
1. Data Controller
Magdó Józsefné, sole proprietor (AIren Agency), 7633 Pécs, Endresz György utca 17., Hungary, tax number: 90511183-1-22, email: info@airenagency.hu. The Data Controller operates as a sole proprietor with no server or database of its own — data processing always takes place through third-party services (an email account, hosting provider, Microsoft 365, etc.).
2. Legal Basis
Data processing is carried out in accordance with the EU General Data Protection Regulation (GDPR) 2016/679 and applicable Hungarian data protection law.
3. Important Principle: No Database, No Website-Side Storage
The airenagency.hu / airenagency.com website is a static site with no database or server-side storage. This means that data submitted through the website (e.g. via the contact form or the "Written Growth Plan" form) is never saved to a database; the website does not store or archive this data in any form, and has no retroactive access to it. Data entered into these forms is transmitted solely as a one-time email message to the Data Controller's info@airenagency.hu address, where — as part of ordinary business correspondence — it is retained in the Data Controller's email inbox (not on the website!) for the period described in Section 5 below.
Exception: the online booking tool, which also records bookings in a protected folder on the hosting space (see Section 4).
4. Data Collected and Purpose
Contact form: name, email address, phone number (optional), subject of inquiry, message content — purpose: providing quotes, maintaining contact. Legal basis: consent of the data subject (GDPR Art. 6(1)(a)), and/or pre-contractual steps (Art. 6(1)(b)). Data is transmitted by email only and is not stored in any website-side database.
"Written Growth Plan" starter form: name, email address, phone number (optional), company name (optional), the selected package, and the business challenges/goals text entered — purpose: preparing the written strategy or audit. Legal basis: consent of the data subject, and/or pre-contractual steps. Likewise transmitted solely by email.
Online booking tool: name, email address, phone number, company name, website (optional), the selected service, planned budget, timing, message, and the chosen contact channel and time slot — purpose: arranging, confirming and holding the free consultation. Legal basis: consent of the data subject (GDPR Art. 6(1)(a)) and/or pre-contractual steps (Art. 6(1)(b)). This is the only feature that stores data on the website's hosting space: to prevent double bookings and to send the email confirmation, bookings are recorded in a protected, non-public folder on the hosting space and are also delivered to the Data Controller by email. A website address entered when requesting the free SEO review arrives the same way, as part of the booking.
Newsletter signup: name (optional), email address — purpose: sending regular AI news and tips. Legal basis: explicit consent of the data subject, given by accepting this notice before subscribing. Newsletters are sent via Brevo (Sendinblue SAS), a third-party email marketing service with its own privacy policy.
Unsubscribing: you may unsubscribe at any time, without justification — either via the unsubscribe link at the bottom of the newsletter, or by emailing info@airenagency.hu to let us know you no longer wish to receive newsletters. The Data Controller will remove your email address from the newsletter list within 48 hours of receiving the unsubscribe request.
Website usage data (Google Analytics, optional, consent-based only): anonymized traffic, device, and browser data — purpose: analyzing website performance.
AI Chatbot conversations: questions and messages entered in the chat window — these appear only in the visitor's browser for the duration of the session and are not permanently stored by the Provider.
ROI Calculator and other interactive tools: non-identifying business parameters entered (e.g. number of employees, admin hours) — these are not stored by the Provider; they are processed only in the visitor's browser for the duration of the session and are automatically discarded when the page is closed.
5. Data Retention
Since the website has no database of its own, data received through the forms is retained solely in the Data Controller's email inbox — for the period applicable to ordinary business correspondence, under the applicable accounting and civil law statutes of limitation (typically up to 5 years, unless a longer retention period is required by law, e.g. for invoicing records). At the data subject's request, the Data Controller will delete the data earlier, provided no further legal basis for processing exists. Newsletter data: until unsubscribed, deleted within 48 hours of receiving the unsubscribe request. Booking data on the hosting space: up to 90 days after the consultation, unless a contract is concluded.
6. Data Processors
The Data Controller may use the following third-party data processors: the hosting provider serving the website, the Data Controller's email provider, the Brevo (Sendinblue SAS) newsletter service, optionally Google Analytics (Google Ireland Ltd.), and the invoicing system. These providers maintain their own, independent privacy policies, and may process data only under the Data Controller's instructions, for the purposes set out in this notice.
7. Your Rights
You have the right to request information about your data, request correction or deletion, restrict processing, object to processing, and exercise your right to data portability. Requests can be submitted to info@airenagency.hu, and the Data Controller will respond within 30 days at the latest.
8. Remedies
If your rights have been violated, you may file a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9-11., www.naih.hu), or seek judicial remedy.
9. Data Security — What the Data Controller Does and Does Not Undertake
The Data Controller acts with the care expected of it (e.g. using a password-protected, encrypted email account, restricted access). At the same time, it is important to state clearly: as a sole proprietor, the Data Controller does not operate its own server or data center, does not perform regular backups, and does not provide round-the-clock (24/7) technical monitoring. Technical operation of the website, server security, and any backups are the responsibility of the relevant hosting provider; the security of the email account is the responsibility of the email provider (e.g. Microsoft, Google) — their own privacy and security policies apply, and the Data Controller accepts no direct liability for these.