Privacy notice

Last updated: 12 October 2026

Who is responsible for your data?

The controller is Krisztián Rapcsány, sole proprietor (registered address: 2194 Tura, Iskola utca 76., Hungary; tax number: 56848670-1-33; registration number: 55546162). Send your questions and requests about data processing to [email protected].

I have not appointed a data protection officer, because I am not required to. I answer everything myself.

What I process, why, and on what legal basis

• →Contact form: your name, email address, message, and whatever optional details you fill in (topic, whether there is an existing system, technology, timeline, project size). I use them to reply and to prepare a quote. Legal basis: steps taken at your request before entering a contract (GDPR Art. 6(1)(b)), and my legitimate interest in answering your enquiry (Art. 6(1)(f)).
• →Email: if you write to [email protected] yourself, I process the message and the sender address for the same purpose and on the same basis. Mail sent to @rapcsany.hu addresses is forwarded to my mailbox by Cloudflare.
• →If we work together: I also process the data needed for the contract and invoicing (name, address, tax number, invoice details). Legal basis: performance of the contract (Art. 6(1)(b)) and my accounting and tax obligations (Art. 6(1)(c)).
• →Protection against abuse: when the form is submitted, I temporarily store a hash of your IP address and a hash of your email address (not the data itself), to stop mass automated submissions. The form also carries a hidden field and a timestamp that filter out bots. Legal basis: my legitimate interest in protecting the site (Art. 6(1)(f)). This is automatic filtering, but it makes no decision with legal effect and does no profiling.
• →Server logs: the web server and the mail server keep technical logs (time of the request, IP address, the page requested, the browser identifier, and for mail the sender and recipient addresses). I use them for troubleshooting and protection. Legal basis: my legitimate interest in running the site securely (Art. 6(1)(f)).
• →Anonymous usage log: the site keeps its own cookie-free log of which page, button and form step was used, in which language, and where the visit came from (only the domain of the referring site). It stores no IP address, browser identifier or any other identifier, and it respects the browser's "Do Not Track" signal. Since it cannot be tied to a person, I do not treat it as personal data, but I limit how long it is kept anyway. Legal basis, if it did count as personal data: my legitimate interest in seeing what works on the site (Art. 6(1)(f)).

How long I keep it

• →Messages: until the enquiry is closed. If no quote or collaboration follows, for at most 2 years, then I delete them.
• →Invoices and the data that goes with them: for the period required by law (currently 8 years).
• →The anti-abuse hashes: for at most 1 hour.
• →Server logs: for at most about a month, according to the server settings.
• →The anonymous usage log: for at most 13 months, then it is deleted automatically.

Who receives your data

I will not sell your data or hand it over for advertising. To run the site and handle email I use the following providers, who act as processors:

• →DigitalOcean, LLC (105 Edgeview Drive, Ste. 425, Broomfield, CO 80021, USA, [email protected]): hosting and the server. The server is located in Frankfurt (Germany).
• →Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA, [email protected]): handling the domain and the traffic (DNS, caching, attack protection), and forwarding mail sent to @rapcsany.hu. When you visit the site, your request passes through Cloudflare's network, where your IP address and request data are processed for security and operational purposes.
• →Google (Gmail): storing my incoming mail, including the messages you send through the form.

Transfers outside the EU

DigitalOcean and Cloudflare are US companies, so your data may leave the European Economic Area even though the server is in Germany. The transfer relies on the EU-US Data Privacy Framework, in which both companies are certified. If that framework ceased to apply, the Commission's standard contractual clauses (SCCs) would take its place. Google acts under its own terms and standard contractual clauses.

Cookies and browser storage

The site uses no analytics, marketing or tracking cookies, so it does not ask for cookie consent.

• →Two technical cookies are set in your browser on every page load: the session cookie (rapcsany_krisztian_session), which lets me restore your form after an error, and XSRF-TOKEN, which protects against forged submissions. Both last 2 hours, they do not identify you, and they do not follow you. They are strictly necessary for the site to work, so they do not need consent.
• →Your browser's local storage keeps two values: the appearance you chose (light or dark theme), and whether you answered the language prompt. It never leaves your device, and you can delete it in your browser settings at any time.
• →Cloudflare may also use a technical cookie for its own security features. You can read about that in Cloudflare's own notice.

How I protect your data

The site is only available over an encrypted (HTTPS) connection, with a strict Content Security Policy. Only I can access the server, with key-based login, a firewall and automatic blocking, and I keep the system updated. Outgoing mail is digitally signed (SPF, DKIM, DMARC).

Your rights

You can ask me at any time what data I hold about you, and you can ask for a copy. You can ask for your data to be corrected or erased, restrict how I process it, object to processing that rests on my legitimate interest, ask for your data in a machine-readable form where it rests on a contract or consent, and withdraw any consent you have given.

Send your request to [email protected]. I will answer within a month. If the request is complex or there are many, this can be extended by up to two further months, but I will tell you within the first month.

If you feel I have violated your rights, you can complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9-11., Hungary; postal address: 1363 Budapest, Pf. 9.; email: [email protected]; website: naih.hu. You can also go to court, and the case can be brought before the regional court of your place of residence or stay.

Changes

If my data processing changes (for example if I add a new provider or a new kind of measurement), I will update this notice and change the date at the top of the page.