Privacy Policy

1. INTRODUCTION

Welcome to the IntaVolve website, registered users of the service, and people who complete interactive content (collectively, the “Data Subjects”).

1.1 Who are we, and who is the data controller?

Name and address of the data controller: Papp Dalma Zsuzsanna, sole proprietor, 2330 Dunaharaszti, Dárda utca 1/1, Hungary.

Privacy contact: [email protected]; telephone: +36 30 797 4731.

Website and service: https://intavolve.com/

1.2 Where can I obtain information about the processing of my personal data?

We process Data Subjects’ personal data as described in this Privacy Notice. You may request further information about our processing of personal data by emailing [email protected].

To understand this notice, it is useful to be familiar with the meaning of “personal data”.

1.3 What is personal data?

Personal data means any information relating to an identified or identifiable natural person. Examples include a name, number, location data, online identifier, or information relating to a person’s physical, mental, economic, cultural or social identity. Other important terms are defined in Annex I.

1.4 What are the main elements of this Privacy Notice?

This notice explains, among other things:

the rules governing the processing of your data;

the data-protection principles we follow;

details of our processing, including what data we process, for what purposes and for how long; and

your rights as a Data Subject.

1.5 What should I consider when providing another person’s data?

Website users should provide only their own data. As a general rule, you must not provide another person’s personal data unless you have obtained that person’s consent in advance where consent is required.

1.6 What rights do I have, and how can I exercise them?

You may withdraw consent to the processing of your personal data at any time. Where processing is based on that consent, we will stop the relevant processing after withdrawal. For example, if you no longer wish to receive our newsletters, you may ask us to stop sending them.

More information about withdrawing consent and exercising other rights is provided in Section I below.

2. DETAILED INFORMATION ABOUT OUR PROCESSING ACTIVITIES

2.1 Enquiries and contact

Data processed: name (if provided), email address, telephone number (if provided), and the content and date/time of communications with customer support.

Purpose: to respond to enquiries, provide customer support and handle requests relating to the service.

Legal basis: depending on the nature of the enquiry, your consent (Article 6(1)(a) GDPR), or steps taken at your request before entering into a contract or performance of a contract (Article 6(1)(b) GDPR).

Retention period: for as long as needed to resolve the enquiry and thereafter, where justified, until the relevant legal claims become time-barred.

Consequences of not providing the data: we may be unable, or only partly able, to respond to your enquiry.

2.2 Registration and user account

Data processed: name, email address, username (if separately used by the system), a securely stored, non-reversible password verification value, registration and login timestamps, IP address, account settings, selected language, and technical and security log data relating to account use. Additional data required for billing when using paid services is described separately below.

Purpose: to create and maintain user accounts, authenticate users, provide service functionality, protect account security and retain user preferences.

Legal basis: performance of the service contract (Article 6(1)(b) GDPR) and, where applicable, our legitimate interests in security logging and preventing misuse (Article 6(1)(f) GDPR).

Retention period: while the account remains active. After account deletion, certain data may be retained for as long as necessary to comply with legal obligations, protect security or establish, exercise or defend legal claims.

Consequences of not providing the data: without a user account, you cannot use features that require registration.

2.3 Service emails and marketing communications

Data processed: name, email address, the fact and date of subscription, details of withdrawal of consent, and technical data relating to messages sent.

Purpose: to send messages required to operate the service (for example, account, security, subscription or service-change notifications) and, where separate consent is required and has been given, newsletters, product news and marketing offers. Service messages are distinguished from marketing messages.

Legal basis: performance of a contract or compliance with a legal obligation for service messages; your consent (Article 6(1)(a) GDPR) for marketing messages, which may be withdrawn at any time.

Retention period: until marketing consent is withdrawn, and for as long as necessary for service-related messages. We may retain limited information about a withdrawal of consent to maintain a suppression list and avoid sending further marketing messages.

Consequences of not providing the data: without marketing consent, you will not receive marketing messages; essential service notifications may still be sent.

2.4 Use of the service and subscriptions

Data processed: name, email address, country, subscription plan, subscription status and dates, information about features used and quotas, transaction identifiers, IP address and technical data necessary to use the service.

Purpose: to provide IntaVolve’s interactive-content creation service, including creating, editing, publishing and managing quizzes, assessments, scorecards, calculators, recommendations and lead-qualification forms; manage subscriptions and plan entitlements; enforce usage limits; provide customer support; and prevent misuse.

Legal basis: performance of a contract (Article 6(1)(b) GDPR), compliance with legal obligations (Article 6(1)(c) GDPR) and, depending on the processing activity, our legitimate interests in security, fraud prevention and the establishment, exercise or defence of legal claims (Article 6(1)(f) GDPR).

Retention period: for the duration of the service relationship and thereafter for the period required by applicable retention obligations or limitation periods for legal claims.

Consequences of not providing the data: you will not be able to use features that require registration or a paid subscription.

2.5 Refund-related processing concerning natural-person Data Subjects

Data processed: name, bank account number, subscription details and other information needed to make a refund.

Purpose: to fulfil a refund obligation arising under applicable law or the Terms of Use.

Legal basis: performance of contractual obligations relating to the provision of the service (Article 6(1)(b) GDPR). After the refund, our legitimate interest under Article 6(1)(f) GDPR applies until the general limitation period under the Hungarian Civil Code expires, currently five years.

Legitimate interest, where applicable: to pursue or defend legal claims during the limitation period and to support our position with appropriate records in regulatory or other proceedings.

Retention period: until the contractual obligation has been fulfilled and for a further five years, as described above.

Consequences of not providing the data: we may be unable to issue a refund using a method that requires the missing information.

2.6 Invoicing-related processing concerning natural-person Data Subjects

Data processed: name, email address, telephone number, residential address, billing address and other invoice-related information.

Purpose: to issue invoices as required by law.

Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR), including the invoicing obligation under Section 159(1) of Hungarian Act CXXVII of 2007 on Value Added Tax.

Retention period: eight years from the invoice date, in accordance with Section 169(2) of the Hungarian Accounting Act.

Consequences of not providing the data: the transaction cannot be completed because the required information must be provided to place an order.

2.7 Interactive content, responses, results and leads

Data processed: the title, description, questions, answer options, scoring or evaluation rules, result texts and calls to action entered by the user who creates interactive content; as well as the answers submitted by participants, calculated scores or results, completion timestamps and—if requested by the form—name, email address, telephone number or other information provided by the participant. The exact data depends on the settings chosen by the creator of the content.

Purpose: to operate interactive content, process responses, calculate scores or results, display personalised feedback, record completion activity and, where the creator configures such fields, collect information about interested people and potential customers and make it available to the content creator.

Legal basis: depending on the relationship between the content creator and participant, the nature of the questions and the data collected, processing may be based on the participant’s consent, performance of a service requested by the participant, or the legitimate interests of the controller responsible for the relevant processing. IntaVolve users are responsible for ensuring that the content they publish, their questions and their data collection comply with applicable data-protection laws and that appropriate notices and legal bases are in place where required.

Retention period: this depends on the content settings, subscription plan and deletion actions taken by the content creator. We process data stored in our service for as long as needed to provide the service; data that must be retained by law or is needed for legal claims may be retained for the necessary period.

Consequences of not providing the data: participants may be able to continue without completing certain fields if the content creator allows this. If fields marked as mandatory are not completed, completion or display of the result may be restricted.

2.8 Handling complaints from natural-person Data Subjects

Data processed:

the consumer’s name and address, and—if consent is given and solely for contact purposes—telephone number and email address;

the place, time and method by which the complaint was submitted;

a detailed description of the complaint and a list of records, documents and other evidence provided by the consumer;

the controller’s statement of its position on the complaint, where it can be investigated immediately;

the name of the person who records the minutes and, except for oral complaints made by telephone or other electronic communications service, the consumer’s signature;

the place and time when the minutes were recorded; and

for oral complaints made by telephone or another electronic communications service, the complaint’s unique reference number.

Purpose: to comply with applicable law and handle consumer complaints.

Legal basis: compliance with a legal obligation under Article 6(1)(c) GDPR. Relevant Hungarian legislation: Section 17/A(5) and (7) of Act CLV of 1997 on Consumer Protection.

Retention period: three years.

Consequences of not providing the data: the Data Subject may be unable to pursue the complaint.

2.9 AI-assisted content creation

Certain IntaVolve features may allow users to use an external artificial-intelligence service. If a user uses AI assistance, a prompt or content entered for that feature may be transmitted to the external provider, depending on the workflow actually used. Users should not include unnecessary personal data, confidential information or third-party personal data in prompts.

If the AI feature directs the user to an external provider and the user copies the prompt into that service, the external provider’s own privacy terms also apply to its processing. The specific provider, categories of data transferred and location of any transfer must be confirmed against the actual integration before publication.

2.10 Processing relating to cookies

We use cookies to support the proper operation of the website and application, certain social and content-delivery functions, website traffic analysis and marketing communications.

Further information about cookie-related processing is provided in Annex II.

2.11 Transfers of data outside the EU

Are data transferred to a country outside the EU? If so, specify an adequacy decision or other appropriate safeguards:

Whether data are transferred outside the EU depends on the providers and settings actually used. This must be verified before this notice is published and supplemented with details of the applicable safeguards where necessary.

3. DATA PROCESSORS

3.1 Hosting provider(s)

Name: DigitalOcean

Location: Frankfurt, Germany

Email: [email protected]

3.2 Invoicing software provider(s)

Name: KBOSS.hu Kft.

Address: 1031 Budapest, Záhony utca 7, Hungary

Email: [email protected]

Name: Emergence Engineering Kft.

Address: 1123 Budapest, Nagyenyed utca 5, basement level, Hungary

Email: [email protected]

3.3 Accounting service provider(s)

Name: Digitbooks Kft.

Address: 1036 Budapest, Lajos utca 131, 6th floor, door 33, Hungary

Email: [email protected]

3.4 Newsletter service provider(s)

Name: Not specified in the source document.

Address: Not specified.

Email: Not specified.

3.5 Online payment service provider(s)

Name: Stripe, Inc.

Address: The One Building, 1 Lower Grand Canal Street, Dublin 2, Ireland

Email: [email protected]

I. RIGHTS OF DATA SUBJECTS AND REMEDIES

In relation to the processing described above, Data Subjects have the rights set out below and may exercise them as described in this section.

You may request information about the data concerning you that we process, and request the rectification, completion, erasure or restriction of your recorded data. You may also exercise your right to data portability and access to your personal data, and object to the processing of your personal data.

Requests to exercise these rights should primarily be submitted to the controller’s representative or, if the controller has appointed one, its Data Protection Officer.

Information and access to personal data

You may submit a written request using the contact details provided above to ask the controller:

which personal data concerning you it processes;

the legal basis for the processing;

the purpose of the processing;

the source of the data;

the retention period; and

to whom, when and on what legal basis the controller has provided access to your personal data or transferred your personal data.

The controller will provide the information in a commonly used electronic format unless you request a paper copy in writing. The controller does not provide information orally, either by telephone or in person.

The controller will provide the first copy of your personal data free of charge (in person at customer service, according to the source document). A reasonable fee based on administrative costs may be charged for further copies. If you request a copy electronically, the controller will provide the information by email in a commonly used electronic format unless you request otherwise.

After receiving the information, if you disagree with the processing or the accuracy of the data, you may request rectification, completion, erasure or restriction, object to the processing, or initiate the procedures described below.

Right to rectification and completion

You may request that inaccurate personal data concerning you be corrected without undue delay. Taking the purposes of processing into account, you may also request that incomplete personal data be completed, including by providing a supplementary statement.

Right to restriction of processing

You may request restriction of processing where one of the conditions set out in applicable data-protection law is met, including where you contest the accuracy of the data (for the period needed to verify it), where processing is unlawful and you oppose erasure, where the controller no longer needs the data but you need it for legal claims, or where you have objected to processing pending verification of whether the controller’s legitimate grounds override yours.

Where processing is restricted, the data—apart from storage—will generally be processed only with your consent, for legal claims, to protect another person’s rights, or for important public-interest reasons, as permitted by law.

Right to erasure (“right to be forgotten”)

You may request erasure of personal data concerning you where the conditions under applicable law are met, for example where the data are no longer necessary for the purposes for which they were collected, you withdraw consent and there is no other legal basis, you successfully object to processing, or the data have been unlawfully processed.

Erasure may be refused to the extent that processing is necessary to comply with a legal obligation or to establish, exercise or defend legal claims, or where another statutory exception applies.

Right to data portability

Where the processing is based on consent or a contract and carried out by automated means, you may have the right to receive the personal data you provided in a structured, commonly used and machine-readable format and, where technically feasible, to transmit those data to another controller without hindrance.

Right to object to processing

You may object, on grounds relating to your particular situation, to processing based on the controller’s legitimate interests or a task carried out in the public interest, where the law grants this right. The controller will stop the processing unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. You may object at any time to the processing of personal data for direct marketing; in that case, the data will no longer be processed for that purpose.

Exercise of rights after death

Under the applicable Hungarian rules, certain rights of a deceased Data Subject may be exercised by an authorised person or close relative in the circumstances provided by law. On written request, the controller must inform the close relative of the measures taken unless the deceased expressly prohibited this in a declaration.

Withdrawal of consent

You may withdraw your consent to the processing of personal data at any time. After withdrawal, the controller will stop processing the data covered by the consent unless another legal basis permits the processing. The controller will inform you of any such exception and of the handling of your data as described in this notice.

Time limit for responding to requests

The controller will inform you of the action taken without undue delay and in any event within one month of receiving your request. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests. In that case, the controller will inform you of the extension and the reasons for the delay within one month of receiving the request, and advise you of your right to lodge a complaint with a supervisory authority and seek a judicial remedy.

If a request is manifestly unfounded or excessive, in particular because it is repetitive, the controller may charge a reasonable fee reflecting administrative costs or refuse to act on the request. The controller bears the burden of demonstrating that the request is manifestly unfounded or excessive.

If you submitted the request electronically, the information will be provided electronically unless you request otherwise.

Compensation and non-material damages

Any person who has suffered material or non-material damage as a result of an infringement of the GDPR may be entitled to compensation from the controller and/or processor. A processor is liable for damage caused by processing only where it has failed to comply with obligations specifically imposed on processors by law or acted outside or contrary to the controller’s lawful instructions. The controller or processor is exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.

How to enforce your rights

You may exercise your rights by submitting a written request by email or post.

You may be unable to exercise a right if the controller demonstrates that it cannot identify you. If a request is manifestly unfounded or excessive, particularly because it is repetitive, the controller may charge a reasonable fee or refuse to act. The controller bears the burden of proving this. If the controller has doubts about the identity of the person making the request, it may ask for additional information needed to confirm identity.

Under Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information (the “Infotv.”), the GDPR and Act V of 2013 on the Hungarian Civil Code, you may:

lodge a complaint or request with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9–11, Hungary, https://www.naih.hu; or

bring proceedings before a court. At your choice, proceedings may also be brought before the court having jurisdiction over your place of residence. A list of courts and their contact details is available at https://birosag.hu/torvenyszekek.

II. HANDLING PERSONAL DATA BREACHES

A personal data breach is a security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed. The controller keeps a record of personal data breaches to monitor the measures taken and, where required, notify the supervisory authority and Data Subjects. The record includes the categories of personal data and Data Subjects affected, the number of affected persons, the time and circumstances of the breach, its effects and the remedial measures taken.

Unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, the controller will notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. If the breach is likely to result in a high risk to the rights and freedoms of Data Subjects, the controller will inform the affected Data Subjects without undue delay.

III. ACCESS TO DATA, DATA SECURITY AND DATA TRANSFERS

Access to data and data transfers

The controller’s employees and certain authorised contractors may access personal data only to a limited extent and as necessary to perform their duties.

The controller transfers personal data to other organisations or public authorities only for purposes and in circumstances permitted by law.

Courts, prosecutors, investigative authorities, authorities handling minor offences, administrative authorities, the Hungarian National Authority for Data Protection and Freedom of Information, and other bodies authorised by law may request information, data, or documents from the controller.

Where an authority specifies the precise purpose and scope of its request, the controller will disclose only the personal data that are strictly necessary to fulfil that purpose.

Data security measures

The controller takes all measures reasonably expected to protect data and provide an appropriate level of security, particularly against unauthorised access, alteration, transmission, disclosure, erasure or destruction, as well as accidental destruction or damage. Appropriate technical and organisational measures are used to protect data.

The controller selects and operates the IT tools used to provide the service so that personal data are:

accessible to authorised persons (availability);

authentic and capable of authentication (authenticity);

protected against unauthorised alteration (integrity); and

protected against unauthorised access (confidentiality).

During processing, the controller seeks to preserve:

confidentiality: ensuring that information is accessible only to authorised persons;

integrity: protecting the accuracy and completeness of information and its processing methods; and

availability: ensuring that authorised users can access information and related resources when needed.

If the controller is required to appoint a Data Protection Officer or voluntarily appoints one, the officer’s contact details will be published separately. Where processing is carried out on the controller’s behalf, the controller uses only processors that provide sufficient guarantees to implement appropriate technical and organisational measures and protect Data Subjects’ rights in accordance with the GDPR.

IV. MISCELLANEOUS PROVISIONS

The controller reserves the right to amend this Privacy Notice unilaterally. If this notice changes, the controller will notify Data Subjects by publishing the change on its website and stating the effective date of the updated notice.

If a person provides another natural person’s data or false information and thereby causes damage to the controller, the controller may pursue a claim for compensation against that person.

The controller does not verify the personal data provided to it. The person providing the data is solely responsible for its accuracy. By providing personal data, the Data Subject also confirms that the information is accurate and relates to them.

ANNEX I — DEFINITIONS

“Regulation” means the General Data Protection Regulation, Regulation (EU) 2016/679 of the European Parliament and of the Council.

“Controller” means the organisation or legal person identified in Section 1.

“Personal data” means any information relating to an identified or identifiable natural person (“Data Subject” in this document). An identifiable natural person is someone who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, number, location data, online identifier, or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.

“Processing” means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Restriction of processing” means marking stored personal data with the aim of limiting their processing in the future.

“Profiling” means any form of automated processing of personal data used to evaluate personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

“Processor” means a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.

“Recipient” means a natural or legal person, public authority, agency or other body to which personal data are disclosed, whether or not it is a third party. Public authorities that may receive personal data in the context of a particular inquiry under EU or Member State law are not regarded as recipients; their processing must comply with the applicable data-protection rules for the purposes of processing.

“Consent of the Data Subject” means a freely given, specific, informed and unambiguous indication of the Data Subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

“Personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

ANNEX II — COOKIE NOTICE

What are cookies?

Cookies are data files stored by a browser on a user’s computer or device.

What do cookies do?

Cookies collect information about a user’s activity on websites and allow a website to remember settings and actions. Users can configure their browsers to accept or reject cookies. Cookies may also enable certain content, such as videos, to be displayed.

What types of cookies are there?

Many types of cookies are used on different websites. The categories listed in the source document are:

Functional (essential or necessary) cookies

Analytics cookies

Advertising cookies

Purpose of processing

Cookies may be used to identify users, prevent data loss, distinguish users from one another, maintain user sessions and store information provided during those sessions. Users can delete cookies from their devices.

Legal basis

Consent of the Data Subject (Article 6(1)(a) GDPR) and, for functional cookies, legitimate interests (Article 6(1)(f) GDPR), as stated in the source document. The actual legal basis must be checked against the cookies in use and applicable law.

Types of personal data processed

Identifier, previously visited page, time and date.

Retention period

Until the end of the session or, in some cases, up to 365 days after the session ends (the source document refers to a mobile-version tracking cookie and a cookie that remembers items added to a basket; these references must be checked for relevance to IntaVolve).

You can manage cookies in the following browsers by following their support links:

Safari: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac

Chrome: https://support.google.com/chrome/answer/95647

Edge: https://support.microsoft.com/hu-hu/help/4027947/microsoft-edge-delete-cookies

Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer

1. Functional (essential or necessary) cookies

Cookies that improve website usability may enable navigation and access to logged-in areas. Without them, the website may not function properly.

Purpose: tracking a website visit/session.

Legal basis: the source document states consent under Article 6(1)(a) GDPR and also refers to the controller’s legitimate interest in the basic operation of the website and application. These statements should be checked against the actual cookie setup and applicable law before publication.

Retention period: generally while the user actively browses the website, ending with the session; in some cases, cookies may remain for longer.

2. Analytics cookies (_ga and ga)

Purpose: statistical analysis of website visitors’ behaviour without identifying individual website users by name.

Legal basis: consent under Article 6(1)(a) GDPR, as stated in the source document.

Retention period: two years after the last website visit, as stated in the source document. Verify the actual cookie names and durations before publication.

3. Advertising cookies

Data processed: the source document states that the controller does not hold personal data for this purpose.

Purpose: targeting marketing and displaying advertisements based on your website visits and activity.

Legal basis: consent under Article 6(1)(a) GDPR, as stated in the source document.

Retention period: 180 days after the last visit for Facebook cookies and 360 days after the last visit for Google cookies, as stated in the source document. These periods and providers must be verified against IntaVolve’s actual setup.

Categories of recipients: none listed in the source document.

Consequences of not providing the data: the controller may be unable to show you personalised advertisements on Google and Facebook.

Logging by the web-server operator based on IP address

Data processed: IP address.

Purpose: to prevent attacks against the website and investigate any attacks after they occur.

Legal basis: legitimate interests (Article 6(1)(f) GDPR).

Legitimate interest: the controller’s interest in secure website operation, protecting visitors’ personal data and the controller’s business secrets, investigating possible attacks and preventing crime.

Retention period: one year from your last website visit, as stated in the source document.

Categories of recipients: the web-server hosting provider.

For general information about cookies, the source document links to: https://gdpr.eu/cookies/