Privacy policy

This Privacy Policy (hereinafter: “Privacy Policy”) applies to the website operated under the name “thyone software” at https://thyonesoftware.com (hereinafter: “Website”) by Imola Mészár, sole trader (registered office: 1119 Budapest, Andor utca 21/C, Hungary; tax number: 59340580-1-33; EU VAT number: HU59340580; registration number: 57362151; hereinafter: “Data Controller”), and describes the characteristics of the data processing carried out in connection with the Website and the Data Controller’s services, in particular the collection, storage and use of data.

This Privacy Policy takes effect on 11 October 2026. The Data Controller makes the current version of the Privacy Policy available on the Website and at its registered office.

This Privacy Policy has been drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: “GDPR”), with regard to the provisions of Hungarian Act CXII of 2011 on the Right to Informational Self-Determination and on Freedom of Information (hereinafter: “Info Act”). Its terminology corresponds to the definitions set out in Article 4 of the GDPR and, in certain respects, is supplemented by the interpretative provisions of Section 3 of the Info Act and the definitions contained in the Data Controller’s General Terms and Conditions. The Data Controller’s General Terms and Conditions are available on the Website at all times.

In matters not covered by this Privacy Policy, the GDPR applies; where the GDPR so permits, the provisions of the Info Act apply on a supplementary basis.

The Data Controller reserves the right to amend this Privacy Policy. Where an amendment affects the use of the personal data provided by the data subject, the Data Controller informs the data subject of the change in an appropriate manner, for example by an information letter sent by email. Where the essential circumstances of the data processing also change as a result of an amendment, the Data Controller specifically requests the data subject’s consent.

Please read the information below carefully and only use the services available on the Website if you agree with the terms set out here.

1. The Data Controller

The Data Controller is not required to appoint a data protection officer and has not appointed one.

2. Principles

In providing its services, the Data Controller pays particular attention to the protection of personal data, compliance with mandatory legal provisions, and the secure and fair processing of data. The Data Controller treats the personal data provided to it as confidential; in its procedures it observes the principles of lawfulness, fairness and transparency under the GDPR; it processes personal data in a purpose-limited manner, also bearing in mind the principle of data minimisation; it complies with the principle of storage limitation; it protects the confidentiality and integrity of personal data; and it takes into account the principle of accuracy under the GDPR.

3. Methods and security of data processing

The Data Controller ensures the security of the data, takes the technical and organisational measures and establishes the procedural rules necessary to enforce the data protection and confidentiality rules laid down in the GDPR, the Info Act and other legislation. The Data Controller protects personal data against unauthorised access, alteration, disclosure, accidental erasure, destruction and damage, and against becoming inaccessible as a result of changes in the technology used.

The Website is available exclusively over an encrypted (HTTPS) connection. The Website does not store quote requests in a database: the content of a quote request reaches the Data Controller by email only and is retained in the Data Controller’s mailbox. The Website serves its fonts and all other resources from its own server, so the visitor’s browser sends no request to a third party without the visitor’s consent.

4. The individual processing activities

4.1. Quote request

The Data Controller provides a form on the Website through which interested parties may request a quote for custom software development services (website, web application, custom business application, search engine optimisation). The name, email address, project type, intended deadline, the answer regarding an existing website and the project description are mandatory; the company name and the address of an existing website are optional. Before submitting the form, the requester confirms by means of a checkbox that is not pre-ticked that they have taken note of this Privacy Policy.

A submitted quote request arrives by email in the Data Controller’s mailbox; the requester receives an automatic confirmation at the address given, which does not contain the content of the request. The Data Controller does not store the quote request on the Website.

Abuse protection on the quote form. So that the form cannot be used for bulk, automated submissions or for flooding another person’s mailbox, the Data Controller’s server limits how many quote requests may be sent within one hour from one visitor address and from the whole Website, and how many confirmations may be sent within one hour in total and within one day to one email address. For this purpose the server stores a one-way digest of the sender’s IP address and of the email address entered, computed with a secret key (HMAC-SHA256), together with the time of the attempt. The key is kept only on the server, so without the key neither the IP address nor the email address can be recovered from the digest; the Data Controller stores neither in any other form for this purpose. The form also contains a field invisible to the visitor; a submission in which that field has been filled in by an automated agent is discarded by the server. Where a limit is exceeded, the request does not reach the Data Controller and the visitor is shown the error page; where a confirmation limit is exceeded, the request is received and only the confirmation is omitted.

The program receiving the form keeps an operational log that contains event codes only (for example a failed validation, a rejected attempt or a failed email delivery) and no personal data.

4.2. Contact by email

The Data Controller gives visitors to the Website the opportunity to contact it at the email address given in Section 1. Remarks and complaints about the Data Controller’s services and the Website are also received and answered by email under this section.

4.3. Records of contractual partners and their contact persons

The Data Controller maintains records of its clients and contractual partners. As a general rule, the Data Controller processes personal data contained in contracts until the performance of the contract, on the legal basis set out in Article 6(1)(b) of the GDPR. The Data Controller’s contractual partners include legal entities and organisations without legal personality, whose data as a general rule do not constitute personal data; the data of the contact persons designated in the contract, who are employees, agents or representatives of the partner and have no contractual relationship with the Data Controller, are processed by the Data Controller for the purpose of maintaining contact, on the basis of its legitimate interest.

Any further data processors engaged in the performance of the contract (for example an accountant or invoicing software) and the processing relating to invoicing that is based on a legal obligation are set out in the individual contract or in the information forming part of it.

4.4. Measuring traffic (Google Analytics)

The Data Controller uses the Google Analytics 4 service of Google Ireland Limited to measure the use of the Website. Measurement is carried out with cookies, which are only set with the data subject’s prior consent given in the cookie banner; without consent, the Google Analytics code is not loaded and the visitor’s browser sends no request to Google. Google Signals and the advertising features are switched off.

The data subject’s decision is kept in the thyone_consent cookie for 180 days. The decision can be changed at any time with the “Cookie settings” control in the footer of the Website. When consent is withdrawn, the Google Analytics cookies are deleted immediately. Detailed information on cookies is provided in the Cookie Policy.

Further information on data processing by Google Analytics: https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245

4.5. Operating the Website (server log)

The web server that serves the Website — the system of the hosting provider Rackforest Zrt. — logs every request, regardless of the visitor’s consent and of the decision made in the cookie banner. The log is necessary for the secure operation of the server, for finding faults and for recognising abuse (such as overload or automated requests). The Data Controller does not combine the log with any other data and does not use it to identify individual visitors.

4.6. Complaints

The Data Controller receives complaints relating to its services at the email address given in Section 1 and by post at its registered office. Complaints from complainants who qualify as consumers are handled in accordance with Hungarian Act CLV of 1997 on Consumer Protection (hereinafter: “Consumer Protection Act”): the Data Controller investigates the complaint and provides a substantive response within 30 days of receipt, and gives reasons where it rejects the complaint. The Data Controller retains the record of the complaint and a copy of the reply for five years. The Data Controller notes that a complainant who is a sole trader qualifies as a consumer under the Consumer Protection Act only where they act for purposes outside their self-employment and economic activity.

4.7. Records relating to the exercise of data subjects’ rights

5. Cookies and browser storage

The Data Controller uses so-called “cookies” in the operation of the Website. A cookie is a small data file that the Data Controller sends to the data subject’s browser and that is stored on the data subject’s device. One cookie (thyone_consent) is essential for remembering the decision made in the cookie banner; the statistical cookies are set by Google Analytics only with consent. The Website uses no advertising cookies.

The Website remembers the light or dark appearance chosen by the visitor in the browser’s local storage (localStorage). This value remains exclusively on the data subject’s device, is not sent to the server, and is necessary to retain a setting expressly requested by the visitor; it therefore requires no consent.

Detailed information on the Data Controller’s use of cookies is set out in the Cookie Policy, which is available on the Website at all times.

6. Data processors

The Data Controller informs data subjects that data processors are not authorised to make independent decisions; they may act solely in accordance with the contract concluded with the Data Controller and the instructions received. Data processors record, manage and process the personal data transferred to them by the Data Controller in accordance with the GDPR. Data processors carry out processing operations on the personal data provided by data subjects within the retention period specified in this Privacy Policy for the respective processing purpose.

In the course of the processing relating to the Website, the Data Controller engages the following data processors:

7. Data subjects’ rights

Data subjects may request information on the processing of their personal data; they may request the rectification of their personal data, the restriction of processing, and — directly from the Data Controller via the contact details in Section 1 — the erasure of their data; they have the right to data portability, the right to a judicial remedy and the right to withdraw consent. In the event of a complaint, a data subject may, within the territory of Hungary, lodge a complaint with the National Authority for Data Protection and Freedom of Information or, at their discretion, bring the matter before a court. The regional court has jurisdiction in such proceedings.

When complying with a data subject’s request regarding the processing of personal data, the Data Controller verifies the data subject’s identity in accordance with this Privacy Policy, taking into account the data subject’s status (requester, client, enquirer, etc.), and is only entitled to comply with the request once the data subject has been adequately identified.

If the applicant has not submitted the request in accordance with this Privacy Policy, and the Data Controller has been unable to verify the applicant’s identity to the standard required for data security and/or confidentiality (i.e. could not identify them as the data subject), the Data Controller asks the applicant to remedy the deficiencies; if the applicant fails to do so, the Data Controller cannot respond to the request.

The time elapsed between the Data Controller’s request for the necessary personal data or the missing action and the actual provision of the data is not included in the time limit for responding to the request.

The Data Controller informs all recipients to whom the personal data have been disclosed of any rectification, erasure or restriction of processing, unless this proves impossible or involves a disproportionate effort. At the data subject’s request, the Data Controller provides information about these recipients.

7.1. Right to information and access

In accordance with Article 13 of the GDPR, where personal data are collected from the data subject, the Data Controller provides the data subject with the following information at the time of collection:

• the identity and contact details of the controller and its representative;
• the contact details of the data protection officer, if any;
• the purposes of the intended processing and its legal basis;
• where applicable, the recipients or categories of recipients of the personal data;
• the period for which the personal data will be stored or, where this is not possible, the criteria used to determine that period;
• the data subject’s right to request access to, rectification or erasure of, or restriction of processing of their personal data, to object to processing, and the right to data portability;
• where processing is based on consent, the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• the right to lodge a complaint with the supervisory authority;
• whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, whether the data subject is obliged to provide the data, and the possible consequences of failing to do so.

Where the personal data have not been obtained from the data subject, the Data Controller provides, in addition to the above and in accordance with Article 14 of the GDPR:

• the categories of personal data concerned;
• the recipients or categories of recipients of the personal data, if any;
• the source of the personal data and, where applicable, whether it came from publicly accessible sources.

Where the personal data have not been obtained from the data subject, the Data Controller provides the information:

• within a reasonable period after obtaining the personal data, but at the latest within one month;
• if the personal data are used for communication with the data subject, at the latest at the time of the first communication; or
• if disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.

The above information need not be provided where:

• the data subject already has the information;
• the provision of the information proves impossible or would involve a disproportionate effort;
• obtaining or disclosing the data is expressly laid down by Union or Hungarian law applicable to the Data Controller, which provides appropriate measures to protect the data subject’s legitimate interests; or
• the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Hungarian law.

The data subject’s right of access — in accordance with Article 15 of the GDPR — extends to the following information:

• the purposes of the processing;
• the categories of personal data concerned;
• the recipients to whom the personal data have been or will be disclosed;
• the envisaged storage period;
• the data subject’s rights in relation to the processing;
• the source of the data, where not collected from the data subject;
• information on automated decision-making.

The Data Controller endeavours in all cases to ensure that the information provided to the data subject is — to the extent possible while complying with the GDPR — concise, transparent, intelligible, easily accessible, clear and plain. The Data Controller is responsible for providing this information and taking the necessary measures. The Data Controller provides the information in writing, including by electronic means. In accordance with the data security rules in Articles 15 and 32 of the GDPR, the Data Controller provides information only if it is satisfied as to the data subject’s identity. If identity cannot be verified, the Data Controller rejects the request and informs the data subject of how they may exercise their rights.

The Data Controller informs the data subject within one month of receiving the request, provided that the request relates to their rights and is set out in a duly communicated statement. Considering the complexity and number of requests, this period may be extended by a further two months, provided that the Data Controller sends a reasoned notification to the data subject within one month of receipt of the request.

A request is deemed duly communicated or received if the data subject sends the written request to the Data Controller’s registered office or to the email address provided for this purpose, and it is received there.

The Data Controller does not consider requests that are not communicated in accordance with the above.

Information and communication relating to the processing of personal data must be easily accessible and comprehensible, and formulated in clear and plain language. This applies in particular to information on the identity of the controller and the purposes of processing, to further information ensuring fair and transparent processing, and to confirmation that data subjects are entitled to obtain confirmation and information on the data processed about them.

The Data Controller provides the information and takes the measures set out in this section free of charge; it charges a fee only in the cases specified in Article 12(5) of the GDPR.

7.2. Right to rectification

The data subject has the right to obtain from the Data Controller, without undue delay, the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of a supplementary statement.

7.3. Right to object

The data subject may object to the processing of their personal data by a statement addressed to the Data Controller if the legal basis of the processing is:

• public interest under Article 6(1)(e) of the GDPR, or
• legitimate interest under Article 6(1)(f) of the GDPR.

Where the right to object is exercised, the Data Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or which relate to the establishment, exercise or defence of legal claims. It is for the Data Controller to determine whether the processing is justified by compelling legitimate grounds.

The Data Controller informs the data subject of its position in a written statement. Until the determination is made, the processing is restricted accordingly.

7.4. Right to restriction of processing

Processing may be restricted in the following cases:

• the data subject contests the accuracy of the data; in this case the Data Controller restricts the processing for a period enabling it to verify the accuracy of the data;
• the processing is unlawful and the data subject requests the restriction of use instead of erasure;
• the controller no longer needs the data, but the data subject requires it for the establishment, exercise or defence of legal claims;
• the data subject has objected to the processing under Article 21 of the GDPR, pending verification of whether the objection is justified.

For the duration of the assessment of the data subject’s objection — but for no longer than 5 days — the Data Controller suspends the processing, examines the merits of the objection and makes a decision, of which it informs the applicant.

If the objection is justified, the Data Controller restricts the data, so that only storage may take place until:

• the data subject consents to the processing;
• the processing is necessary for the establishment, exercise or defence of legal claims;
• the processing is necessary to protect the rights of another natural or legal person; or
• the processing is required by law in the public interest.

Where the Data Controller lifts a restriction, it informs in writing the data subject at whose request the restriction was imposed before lifting it, unless this proves impossible or involves a disproportionate effort. Where the restriction was requested by the data subject, the Data Controller informs them in advance of the lifting.

7.5. Right to erasure (“right to be forgotten”)

The data subject has the right to obtain from the Data Controller the erasure of personal data concerning them without undue delay, and the Data Controller is obliged to erase such data without undue delay where one of the following grounds applies:

• the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• the data subject withdraws the consent on which the processing is based, and there is no other legal basis;
• the personal data have been unlawfully processed;
• the personal data must be erased to comply with a legal obligation under Union or Member State law to which the controller is subject;
• the personal data were collected in relation to the offer of information society services.

The right to erasure may be restricted only where the following exceptions under the GDPR apply, i.e. continued retention may be considered lawful where it is necessary:

• for exercising the right of freedom of expression and information, or
• for compliance with a legal obligation (i.e. for processing based on a legal obligation, for the period appropriate to the purpose), or
• for the performance of a task carried out in the public interest, or
• in the exercise of official authority vested in the controller, or
• for reasons of public interest in the area of public health,
• for archiving purposes in the public interest, or
• for scientific or historical research purposes or statistical purposes, or
• for the establishment, exercise or defence of legal claims.

7.6. Right to data portability

The data subject has the right to receive the personal data concerning them which they have provided to the Data Controller in a structured, commonly used and machine-readable format, and to transmit those data to another controller without hindrance from the controller to which the data were provided, where:

• the processing is based on consent, or on a contract to which the data subject is party, or on steps taken at the data subject’s request prior to entering into a contract [Article 6(1)(a) or (b), or Article 9(2)(a) of the GDPR], and
• the processing is carried out by automated means.

This right does not apply where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller, or where it would adversely affect the rights and freedoms of others.

Where, under the data subject’s right to data portability, the Data Controller is required to disclose personal data to a person other than the data subject, the Data Controller informs and reminds that third-party recipient, within the framework of this Privacy Policy, that they may not use the personal data transferred for their own purposes and may process it solely in accordance with the applicable data protection legislation and for the specified purpose. The Data Controller accepts no liability for the use by a third party of personal data duly transferred at the data subject’s request.

7.7. Right to withdraw consent

Where the legal basis for the processing of a data subject’s personal data is the data subject’s consent, the data subject may withdraw that consent at any time. The Data Controller informs data subjects that, even after withdrawal of consent, it may continue to process the personal data for the purposes of complying with a legal obligation or pursuing its legitimate interests, provided that the pursuit of such interests is proportionate to the restriction of the right to the protection of personal data.

8. Remedies

Data subjects may request information on the processing of their personal data; they may request the rectification of their personal data, the restriction of processing or the erasure of their data by a written request via the contact details set out in Section 1 or by post to the Data Controller’s registered office. Data subjects have the right to object to processing and may exercise their right to data portability. Consent may be withdrawn at any time.

Should a data subject consider that the processing contravenes the GDPR or the Info Act, or consider the Data Controller’s processing of their personal data prejudicial, they may lodge a complaint with the Data Controller via the contact details in Section 1; furthermore, they may lodge a complaint about the Data Controller’s processing directly with the supervisory authority, the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság; address: 1055 Budapest, Falk Miksa utca 9–11., Hungary; postal address: 1363 Budapest, Pf. 9.; telephone: +36 (1) 391-1400; email: ugyfelszolgalat@naih.hu; website: www.naih.hu). Data subjects may also bring the matter before a court, which deals with such cases as a matter of priority. In this case they may choose to bring the claim before the regional court (http://birosag.hu/torvenyszekek) of their place of residence or their place of stay. The competent court can be found at http://birosag.hu/ugyfelkapcsolati-portal/birosag-kereso. Residents of other EU Member States may also contact the supervisory authority of their own country.

---

Questions and requests concerning data processing may be submitted via the contact details set out in Section 1. The terms governing the services are set out in the General Terms and Conditions; detailed information on cookies is set out in the Cookie Policy.