# Privacy policy URL: https://casterconsulting.hu/en/privacy-policy/ Effective from 17 October 2026. ## Data controller Caster Consulting Kft. (company reg. no.: 01-09-378022, VAT ID: 28973713-2-42, e-mail: info@casterconsulting.hu, phone: +36 30 197 0201). Further company details are in the [Legal notice](https://casterconsulting.hu/en/legal-notice/). ## What data we process and why - **Contact form:** name, company, e-mail address, phone number, company size, the selected topic and your message, plus the time, language and page of the submission. Purpose: answering your inquiry and preparing a possible offer. Legal basis: your consent (GDPR Art. 6(1)(a)) and steps prior to entering into a contract (GDPR Art. 6(1)(b)). The submitted data are stored in the website’s database and forwarded to our own mailbox in a notification e-mail. We do not send you an automatic confirmation. - **E-mail correspondence:** if you write to us by e-mail, we process your message and the data in it to reply and to stay in contact. Legal basis: consent and steps prior to entering into a contract. - **Abuse protection:** a one-way, salted hash of your IP address for up to one hour, to filter out excessive submissions. We do not store the IP address itself for this. Legal basis: legitimate interest (GDPR Art. 6(1)(f)). - **Web analytics:** Google Analytics 4 sets cookies and measures visits only after your consent. Without consent, Google Consent Mode v2 sends at most cookieless signals that cannot identify you and are used only for aggregated statistics. Google Analytics 4 does not log or store IP addresses. Legal basis: consent (GDPR Art. 6(1)(a)). - **Server logs and security:** for secure operation the web server and the content management system log requests (IP address, time, requested URL, browser) and, to protect the login page, failed login attempts. Legal basis: legitimate interest (GDPR Art. 6(1)(f)). - **Backups:** the website’s database and files are backed up daily so that we can restore them after a failure or an attack. Backups include contact form data. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) and security of processing (GDPR Art. 32). We do not use automated decision-making or profiling. ## How long we keep data - Contact form and e-mail data: until the purpose of the business relationship ends or until you ask for erasure. There is no automatic deletion. - The IP address hash for abuse protection: one hour at most. - Server logs: 7 days for the website’s logs, 14 days for the web server’s general logs. - Backups: 7 days on the server, 30 days in external storage, so erased data disappear from the backups within 30 days. - Google Analytics 4 data: 14 months. - Comments and messages on our social media pages: on the platform until you or we delete them; a request for an offer sent in a message is kept as long as contact form data. - Cookies: for the periods listed in the [Cookie policy](https://casterconsulting.hu/en/cookie-policy/). ## Who has access: processors Authorised staff of Caster Consulting Kft. have access to the data. The following providers process data as processors, on our behalf and under our instructions: - **RackForest Zrt.** (Victor Hugo utca 11. 5. em. B05001, 1132 Budapest, Hungary): server and hosting, in Hungary. - **Cloudflare, Inc.** (101 Townsend St., San Francisco, CA 94107, USA): speeding up and protecting access to the website (DNS, content delivery, attack filtering). Every request passes through it, so it processes your IP address and the request data. - **Google Ireland Limited** (Gordon House, Barrow Street, Dublin 4, Ireland): Google Workspace e-mail (our correspondence and the contact form notifications), Google Drive (external storage for backups) and – with your consent – Google Analytics 4. We do not sell your data or pass it to third parties for marketing. We disclose data to authorities only where the law requires it. ## Our social media pages (LinkedIn, Facebook) Caster Consulting Kft. has company pages on LinkedIn (linkedin.com/company/caster-consulting) and Facebook (facebook.com/casterconsulting), where we post about our blog articles and services. - **Following, reactions, comments, messages:** if you follow our page, react, comment or send us a message, we see your public profile data, your comment and your message, and process them to reply and to stay in contact. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) and, for an inquiry sent in a message, steps prior to entering into a contract (GDPR Art. 6(1)(b)). We leave these data on the platform and do not save them separately; a request for an offer sent in a message is handled like an e-mail inquiry. - **Instant reply:** a message sent through Facebook Messenger receives an automatic reply that only confirms it has arrived. - **Page statistics:** LinkedIn and Meta provide us with aggregated statistics on visits to our page and interactions with our posts (Page Insights); we cannot identify individuals from them. For these statistics we are joint controllers (GDPR Art. 26) with LinkedIn Ireland Unlimited Company (Wilton Place, Dublin 2, Ireland) and Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland). The joint controller agreements: [LinkedIn](https://legal.linkedin.com/pages-joint-controller-addendum), [Meta](https://www.facebook.com/legal/terms/page_controller_addendum). Under them the platform bears primary responsibility for the statistics, and you can also exercise your rights directly with the platform. Legal basis: legitimate interest (GDPR Art. 6(1)(f)). - **The platforms’ own processing:** LinkedIn and Meta process your user data as independent controllers under their own privacy policies: [LinkedIn](https://www.linkedin.com/legal/privacy-policy), [Meta](https://www.facebook.com/privacy/policy/). - **On this website:** we use no LinkedIn or Facebook tracking code (pixel), and the share buttons under the articles are plain links: data reach the platform only when you click one. When we publish our posts, the website stores only the IDs of our own posts, not data about the platforms’ users. ## Transfers outside the European Economic Area Cloudflare, Inc., Google LLC (the parent company of Google Ireland Limited) and, for our social media pages, LinkedIn Corporation and Meta Platforms, Inc. may also process data in the United States. All of them participate in the EU-U.S. Data Privacy Framework, covered by an adequacy decision of the European Commission, and also apply the standard contractual clauses (SCC) adopted by the Commission. ## How we protect data The website is available only over an encrypted (HTTPS) connection. Only authorised persons can access the server and the administration area, with two-factor authentication. The server firewall lets through only the traffic needed, the system is updated regularly, and restoring from backups is tested every month. ## Your rights - request information about and a copy of your data, - request rectification or erasure, - request restriction of processing and object to processing based on legitimate interest, - withdraw your consent at any time (without affecting the lawfulness of earlier processing), - request your data in a portable format. Send your request to info@casterconsulting.hu; we reply within one month at the latest. You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, Falk Miksa utca 9–11., 1055 Budapest, ugyfelszolgalat@naih.hu, naih.hu) or go to court. ## Cookies See our [Cookie policy](https://casterconsulting.hu/en/cookie-policy/); you can change your choices at any time with the “Cookie settings” link in the footer. ## Changes to this policy We update this policy when our processing or the law changes. The version in force is always available on this page.