Privacy Notice

Effective from: 28 September 2026

This notice explains how the operator of the website alldone.hu processes the personal data of visitors and customers. It is based on the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.) and Hungarian Act C of 2003 on Electronic Communications (Eht.).

1. The controller

The controller is Alldone Hungary Kft. (the “Controller”).
Registered office: 1149 Budapest, Pillangó utca 16–20.
Registry court: Fővárosi Törvényszék Cégbírósága
Company registration number: 01-09-339376
Tax number: 26689508-2-42
E-mail: info@alldone.hu
Phone: +36 30 741 1496

The Controller has not appointed a data protection officer.

2. Processing activities

2.1. Delivering and securing the website

  • Purpose: displaying the website, secure and error-free operation, detecting errors and attacks
  • Data: your IP address, the time of the request, the address of the page requested, data about your browser and operating system, the result of the request (status code)
  • Legal basis: the Controller’s legitimate interest in delivering the website securely and without errors (Article 6(1)(f) GDPR)
  • Retention: 1 day in the hosting provider’s logs
  • Providing the data: a technical condition for displaying the website
  • Recipients: hosting provider (Vercel Inc., see section 3, “Processors and recipients”)

2.2. Contact (contact form, e-mail, phone)

  • Purpose: answering your message and keeping in contact
  • Data: name, e-mail address, phone number (if you give it), the subject of your enquiry (the project you choose), the content of the message and any other data you choose to include; when the form is submitted, the website also records the language of the form and the address of the page from which the message was sent
  • Legal basis: the Controller’s legitimate interest in answering enquiries (Article 6(1)(f) GDPR); where the enquiry is aimed at concluding a contract, steps taken at your request before entering into a contract (Article 6(1)(b) GDPR)
  • Retention: 1 year after the matter is closed, after which the Controller deletes the message; if the matter is never closed, the Controller deletes the message 2 years after it was received
  • Providing the data: voluntary; without the fields marked as required (name, e-mail address) the Controller cannot answer your message
  • Recipients: the hosting provider (Vercel), the database provider (Neon), the provider sending the notification e-mail (Resend) and the provider of the Controller’s e-mail account (see section 3, “Processors and recipients”)

2.3. Complaints

  • Purpose: receiving, examining, answering and documenting consumer complaints
  • Data: name, home or e-mail address, phone number, contract ID, description of the complaint, data about the product or service, documents presented, the content of the written record (jegyzőkönyv) and of the answer
  • Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR; Section 17/A of Hungarian Act CLV of 1997 on Consumer Protection (Fgytv.))
  • Retention: the written record of a complaint, the written complaint and a copy of the answer: 3 years (Fgytv. Section 17/A(7))
  • Providing the data: required by law; without them the complaint cannot be examined
  • Recipients: the provider of the Controller’s e-mail account, and the hosting and database providers (see section 3, “Processors and recipients”); the consumer protection authority, at the request of the supervisory authority

2.4. Cookies and analytics

Cookie settings and consent management

When you first visit the website, a banner lets you decide whether you consent to the functions that the website does not need in order to work. The “Necessary only” button refuses them, and the “Accept all” button allows them. With the “Settings” button you can decide category by category. The categories are:

  • Strictly necessary: always on, cannot be switched off.
  • Statistics: website analytics with Google Analytics (see “Website analytics (Google Analytics 4)” below).

Without your consent, the website does not load the measurement in the Statistics category.

How your choice is stored: the ccb_consent cookie

The website stores your choice in its own cookie, set on the website’s domain, named ccb_consent. The cookie contains only the version of this notice, which categories you consented to and which you did not, and the time of your decision. It contains no unique identifier, name, e-mail address or IP address.

  • Purpose: to remember your choice so that the website respects it on every page and does not ask you again on every visit.
  • Expiry: at most 6 months (182 days) from your decision. After that, or if this notice or the services used change materially, the website asks you again.
  • Legal basis: the website places this cookie when you save your choice with a button, after the information given in the banner and in the “Cookie settings” window; the cookie serves only to carry out this operation you requested (Section 155(4) of the Eht.). To the extent that the cookie’s content is personal data, the legal basis is the Controller’s legitimate interest in respecting your choice (Article 6(1)(f) GDPR). The cookie contains nothing else and serves no other purpose.

If you delete cookies in your browser, your choice is deleted too, and the banner appears again on your next visit.

Changing your choice and withdrawing consent

You can change your choice and withdraw your consent at any time. Click “Cookie settings” in the website footer, or the “Cookie settings” button in the bottom-left corner of the screen, and save your new choice. Withdrawal does not affect the lawfulness of processing before the withdrawal (Article 7(3) GDPR).

If you withdraw your “Statistics” consent, the website stops measurement and deletes the Google Analytics cookies.

Cookies used by the website
  • ccb_consent
    Set by: the website (first-party)
    Purpose: remembers your cookie choice (consent or refusal)
    Category: strictly necessary
    Expiry: at most 6 months (182 days) from your decision
  • _ga
    Set by: Google Analytics (on the website’s domain)
    Purpose: distinguishes browsers with a pseudonymous identifier, for analytics
    Category: statistics, only with consent
    Expiry: 2 years from your last visit on which you allowed measurement; deleted by the website when you withdraw consent or your consent expires
  • _ga_CTEVSVJR5N
    Set by: Google Analytics (on the website’s domain)
    Purpose: keeps the state of the session, for analytics
    Category: statistics, only with consent
    Expiry: 2 years from your last visit on which you allowed measurement; deleted by the website when you withdraw consent or your consent expires

The website creates the strictly necessary cookie only for a function you request, saving your cookie choice, as a result of your action. Statistics cookies are only created after you consent.

Cookies of the website’s administration area are only created for the website’s administrators when they log in, never for visitors.

Website analytics (Google Analytics 4)

Purpose. The Controller uses Google Analytics 4 to measure how the website is used. Aggregated statistics show which pages visitors open, where they come from and where they leave, and the Controller uses them to improve the website.

When measurement runs. Measurement starts only if you consent to it in the cookie banner with “Accept all”, or by switching on the “Statistics” category in the “Cookie settings” window. Without your consent the Google Analytics code is not even loaded, so Google receives no measurement data. Measurement only runs on alldone.hu and www.alldone.hu.

Data processed.

  • a randomly generated pseudonymous identifier stored in the Google Analytics cookie. It distinguishes your browser, but does not contain your name or contact details;
  • the address (URL) and title of the pages you view, the referring page, the time and duration of the visit, and certain interactions (for example scrolling, clicks on external links, file downloads);
  • technical data about your device and browser (device type, operating system, browser, screen size, language);
  • your approximate location derived from your IP address (country, region, city).

Google Analytics does not log or store the IP addresses of visitors from the European Union. It uses the IP address only to derive an approximate location, does this on servers in the EU, Switzerland or the UK, and then discards the IP address immediately.

Legal basis. Your consent (Article 6(1)(a) GDPR). Storing information on your device and accessing it (for example setting and reading cookies) also requires your consent under Section 155(4) of Hungarian Act C of 2003 on Electronic Communications (Eht.). You can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.

Retention. The Controller has set Google Analytics data retention to 14 months. Google keeps the event-level data of visits (for example the pages viewed) for 14 months from when they were recorded. The retention period of the user-level data linked to the pseudonymous identifier that distinguishes your browser restarts with every new visit on which you have allowed measurement; if you do not return in this way within 14 months, Google deletes the user-level data linked to that identifier. Google deletes expired data automatically every month. Aggregated statistical reports (for example the number of visits per day) are not affected by this retention period and remain after it; they contain no individual identifiers.

Measurement uses the _ga and _ga_CTEVSVJR5N cookies; they are described above, under “Cookies used by the website”. The expiry restarts on every visit on which you have allowed measurement. You can delete these cookies in your browser at any time. If you withdraw your “Statistics” consent, the website deletes them immediately; if your consent expires after 6 months, it deletes them on your next visit.

Processor. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland). Google processes the measurement data as the Controller’s processor, under the Google Analytics Terms of Service and the Google Ads Data Processing Terms (see section 3, “Processors and recipients”).

Transfers to third countries. Google may also process the data in the United States, at Google LLC. Google LLC is certified under the EU-U.S. Data Privacy Framework, so transfers to it are covered by the European Commission’s adequacy decision (Implementing Decision (EU) 2023/1795); where that decision does not apply, Google uses the standard contractual clauses adopted by the European Commission.

Advertising. The Controller does not use the measurement for advertising. The website always blocks storage for advertising purposes and does not link the measurement data to Google’s advertising services.

How to withdraw your consent. Click “Cookie settings” in the website footer, or the “Cookie settings” button in the bottom-left corner of the screen. Switch off “Statistics” and save your choice. The website then stops measurement and deletes the _ga and _ga_… cookies.

More about Google’s data processing: https://policies.google.com/privacy and https://policies.google.com/technologies/partner-sites

3. Processors and recipients

The Controller gives access to personal data only to the service providers needed to run the website and for the purposes described below. The Controller engages its processors directly: Vercel, Neon and Resend (see below), and Google for website analytics (see section 2.4, “Cookies and analytics”). The terms of the processing (Article 28(3) GDPR) are set out in each provider’s own data processing terms: for Vercel and Resend, the provider’s Data Processing Addendum; for Neon, the provider’s data processing terms (DPA); for Google Analytics, the Google Ads Data Processing Terms. Processors may not use the data for their own purposes. Where a provider processes certain data for its own purposes, as an independent controller, this is stated for that provider.

Hosting and delivery: Vercel

Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA; privacy@vercel.com). Vercel hosts and delivers the website, runs the server-side functions that process form submissions, and stores uploaded files (Vercel Blob). In doing so, Vercel has access to the data entered on the website and to the technical data needed for delivery (for example IP address, time and address of the request, browser data). Vercel delivers the website from servers located around the world. The data may also be processed in the United States. Vercel Inc. is certified under the EU-U.S. Data Privacy Framework, so transfers to it are covered by the European Commission’s adequacy decision (Implementing Decision (EU) 2023/1795); where that decision does not apply, Vercel uses the standard contractual clauses adopted by the European Commission.

Database: Neon

The Neon database service is provided by Databricks, Inc. (160 Spear Street, Suite 1300, San Francisco, CA 94105, USA; privacy@databricks.com), the parent company of Neon, LLC. This database stores the data entered in the website’s forms (see each processing activity). The provider may also process the data in the United States. Databricks, Inc. and Neon, LLC are certified under the EU-U.S. Data Privacy Framework, so transfers to them are covered by the European Commission’s adequacy decision (Implementing Decision (EU) 2023/1795); where that decision does not apply, the provider uses the standard contractual clauses adopted by the European Commission.

E-mail delivery: Resend

Plus Five Five, Inc. (trading as Resend; 2261 Market Street #5039, San Francisco, CA 94114, USA). Resend sends the e-mails generated by the website (the notification of a form submission sent to the Controller). For this it processes the recipient’s and sender’s e-mail addresses and the content of the message, which contains the data entered in the form. The data may be transferred to the United States. Plus Five Five, Inc. is certified under the EU-U.S. Data Privacy Framework, so transfers to it are covered by the European Commission’s adequacy decision (Implementing Decision (EU) 2023/1795); where that decision does not apply, Resend uses the standard contractual clauses adopted by the European Commission.

Other recipients

  • E-mail provider: e-mails sent to the Controller, and the Controller’s replies, are stored by the provider of the Controller’s e-mail account.
  • Authorities: where the law requires it, the Controller discloses data at the request of a court, authority or other entitled body.

4. Transfers outside the European Economic Area

Some providers (see section 2.4, “Cookies and analytics”, and section 3, “Processors and recipients”) may also process data outside the European Economic Area, mainly in the United States. The Controller allows such transfers only in line with Chapter V GDPR: on the basis of a European Commission adequacy decision (Article 45 GDPR; Implementing Decision (EU) 2023/1795 for providers certified under the EU-U.S. Data Privacy Framework), or subject to appropriate safeguards, in particular the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR). Sections 2.4 and 3 state the solution used for each provider. The text of the European Commission’s standard contractual clauses is available in the Annex to Implementing Decision (EU) 2021/914 (https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj); you can also ask the Controller at info@alldone.hu for information on the safeguards used by each provider.

5. Data security

The Controller uses appropriate technical and organisational measures to protect personal data. The website is only available over an encrypted (HTTPS) connection, and only authorised persons can access the data. The administration area is password-protected.

6. Your rights and remedies

You have the following rights regarding the processing of your personal data:

  • Access (Article 15 GDPR): you can ask whether the Controller processes your personal data and, if so, which data, for what purpose, for how long and to whom it discloses them. You can also ask for a copy of your data.
  • Rectification (Article 16): you can ask for inaccurate data to be corrected and incomplete data to be completed.
  • Erasure (Article 17): you can ask for your data to be erased, for example if they are no longer needed, if you have withdrawn your consent, or if the processing is unlawful. Erasure is not possible where the law requires the data to be kept (for example accounting documents), or where the data are needed to establish, exercise or defend legal claims.
  • Restriction of processing (Article 18): you can ask the Controller not to use the data other than storing them, for example while it checks their accuracy or your objection.
  • Data portability (Article 20): you can receive the data you provided, which are processed by automated means on the basis of consent or a contract, in a structured, commonly used and machine-readable format. You can also ask the Controller to transmit them directly to another controller where technically feasible.
  • Objection (Article 21): where processing is based on the Controller’s legitimate interests, you can object at any time on grounds relating to your particular situation. The Controller must then stop, unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims. You can object to direct marketing (for example a newsletter) at any time without giving reasons.
  • Automated decision-making (Article 22): you have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. The Controller does not make such decisions.
  • Withdrawal of consent (Article 7(3)): where processing is based on your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before it. You can withdraw cookie-related consent with the “Cookie settings” link in the website footer.

How to exercise your rights

You can send your request to the Controller by e-mail to info@alldone.hu, or by post to Pillangó utca 16–20, 1149 Budapest, Hungary. If there is reasonable doubt that the request comes from you, the Controller may ask for additional information to confirm your identity.

The Controller responds without undue delay and in any event within one month of receiving the request. This period may be extended by two further months where the request is complex or there are many requests; the Controller will inform you of the extension and the reasons within the first month. If the Controller does not act on the request, it will inform you within one month of the reasons and of your right to lodge a complaint and to seek a judicial remedy. Information and action are free of charge. For manifestly unfounded or excessive requests, in particular repetitive ones, the Controller may charge a reasonable fee or refuse to act (Article 12 GDPR).

Complaint to the supervisory authority

If you consider that the processing of your personal data infringes the law, you can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Article 77 GDPR; Sections 52(1) and 60(1)–(2) of Hungarian Act CXII of 2011, Infotv.):

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Address: Falk Miksa utca 9-11, 1055 Budapest, Hungary
Postal address: 1363 Budapest, Pf. 9, Hungary
Phone: +36 1 391 1400; +36 30 683 5969; +36 30 549 6838
E-mail: ugyfelszolgalat@naih.hu
Website: https://naih.hu
Online filing: https://naih.hu/online-ugyinditas

You can also lodge a complaint with the supervisory authority of another EU Member State, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

Judicial remedy

If you consider that the Controller or a processor processes your personal data in breach of the law, you can go to court (Article 79 GDPR; Section 23 of the Infotv.). At your choice, you can also bring the case before the regional court (törvényszék) of your place of residence or stay in Hungary. Under Article 79 GDPR you may also bring proceedings before the courts of the EU Member State where you habitually reside.

7. Changes to this notice

The Controller may change this notice, in particular if the website’s operation, the services used or the law change. The Controller publishes the amended notice on the website with its effective date. If a change affects cookie consent, the website asks for your choice again in the cookie banner.