Privacy notice

This is a translation; in case of doubt the Hungarian version prevails.

Effective: 29 June 2026.

01The data controller

This notice governs the processing of personal data on the conendigital.hu website operated by Conen Digital and related subdomains, e.g.:
NEXUS AI chatbot
IKER visual website planner
under EU Regulation 2016/679 (GDPR) and Act CXII of 2011 (Infotv.).

02What data we process and why

2.1 Contact form / e-mail

If you contact us via the contact form, by e-mail or by phone, we process the data you provide (name, e-mail address, phone number, message content, optional company details).

• Purpose: responding to your enquiry, preparing a quote, preparing a contract.
• Legal basis: GDPR Article 6(1)(b) — steps prior to entering into a contract, or Article 6(1)(f) — legitimate interest (business communication).
• Retention: for active projects, until the project closes + 5 years (accounting obligation). If we do not proceed with working together: 12 months.

2.2 NEXUS AI chatbot conversations

We log the conversations of the NEXUS AI chatbot embedded in the website (the text of messages typed by the visitor and replies given by the bot, timestamp, identifier of the language model used, technical metadata).

• Purpose: improving the quality of the service, expanding the knowledge base, debugging.
• Legal basis: GDPR Article 6(1)(f) — legitimate interest (service quality improvement).
• Retention: no more than 30 days, then deleted automatically.
• Important: the bot does not identify you — do not share personal data (full name, address, bank card, password) in the conversation. If you do, we will delete it on request within the retention period.

2.3 Technical logs

The infrastructure serving the website (Cloudflare) automatically logs HTTP requests: IP address, browser User-Agent, request timestamp, requested URL, response code. (The NEXUS AI chatbot is operated by a separate provider, Vercel.) These logs are typically stored in the provider's system for ~30 days.

• Purpose: detecting security incidents, error diagnostics, preventing abuse.
• Legal basis: GDPR Article 6(1)(f) — legitimate interest (system security).
• Retention: 30 days.

2.4 Cookies

The website uses strictly necessary cookies, plus — for statistical purposes — the anonymous, aggregated measurements of Google Analytics 4 (via Google Tag Manager) and Microsoft Clarity to analyse usage and improve the user experience. We do not set third-party advertising tracking cookies for marketing purposes. You can delete cookies from your browser at any time or disable them in the browser; some features may then work with limitations.

2.5 NIS2 readiness platform and Policy Pack (account + purchase)

If you create an account or order the NIS2 Policy Pack, we process the following data:

• Account / login: e-mail address (passwordless, "magic-link" login) and the technical data of mandatory two-factor authentication (MFA). Purpose: providing the service and keeping the account secure. Legal basis: GDPR Article 6(1)(b) and (f).
• Company profile for the pack: company name, tax number, registered office, name of the representative, name and e-mail address of the security contact (the names and the e-mail may relate to a natural person). Purpose: producing a document pack tailored to the company. Legal basis: GDPR Article 6(1)(b) — performance of a contract.
• Payment: online payment is handled by Stripe; we neither see nor store bank card data. We process the transaction record and the billing data. Legal basis: performance of a contract + legal (accounting) obligation.
• Storage of the generated pack: we store the document pack completed with your company data on Cloudflare R2 storage, for as long as needed to provide the download.
• Retention: contract data until claims expire (5 years under the Civil Code), invoices for 8 years (Act C of 2000), the account until it is closed.

Note: NIS2 readiness is a commercial service that helps you prepare — we prepare, we do not audit, and we do not provide legal advice.

03Processors and data transfers

We use the following external providers to process the data:

• Cloudflare, Inc. — hosting/CDN for the website, and storage of account and pack data (R2 object storage, database, session store).
• Stripe Payments Europe, Ltd. (Ireland) — handling online payments; card data stays with Stripe and never enters our system.
• Resend, Inc. — delivering transactional e-mails (login link, pack notification).
• Google Ireland Ltd. — Google Analytics 4 / Tag Manager (statistics) and PageSpeed Insights API (for website-audit measurements).
• Microsoft Ireland — Microsoft Clarity (anonymous usage statistics).
• Formspree, Inc. — forwarding form submissions.
• Vercel Inc. (USA) — serving the NEXUS AI chatbot (the main website runs on Cloudflare).
• LLM providers (depending on the configured model, typically OpenAI) — the conversation text is sent to the provider's API to generate the chatbot's replies; under contractual obligation, the providers do not use the chat content for further training.
• GitHub Inc. — the website's source code is stored here; no end-user personal data is placed there.

For processors based outside the EU/EEA, transfers take place with appropriate safeguards under the GDPR (standard contractual clauses – SCC, and the EU–US Data Privacy Framework). We do not pass data to any other third party, except where required by law (e.g. an authority request).

04Your rights

Under the GDPR, you have the following rights:

• Right to be informed — you can ask for confirmation of whether we process data about you, and if so, what data.
• Right to rectification — you can ask for inaccurate data to be corrected.
• Right to erasure ("right to be forgotten") — you can ask for your data to be deleted under certain conditions.
• Right to restriction of processing — you can ask for the data to be stored but not actively processed.
• Right to data portability — you can receive the data you provided in a structured, machine-readable format.
• Right to object — you can object to processing based on legitimate interest.

To exercise your rights, write to [email protected]. We will give a substantive reply within 30 days.

05Complaints and legal remedies

If you feel that the processing does not comply with the law, you can lodge a complaint with the supervisory authority:

You also have court remedies: you can bring a civil action against the controller before the court competent for your place of residence.

06Data security

We transmit and store data over an encrypted channel meeting industry standards (HTTPS/TLS). Access is strictly limited, only to people working on Conen Digital projects. In the event of a data breach, we notify the NAIH within 72 hours as required by law and — where data subjects are likely to face a high risk — the data subjects directly.

07Changes to this notice

We update this notice as needed (when a new service is introduced or the law changes). We show the fact of the change and the effective date at the top of this page. We also notify our active clients of material changes by e-mail.

08Contact for privacy matters

For any privacy-related question, contact us at [email protected]. We have not appointed a separate data protection officer (DPO) as our activities do not reach the threshold in GDPR Article 37; the controller (Chris Conen) is directly responsible for privacy matters.