Privacy Policy

1. Data Controllers

The Website is jointly operated by, and with respect to the data processing carried out on it is jointly controlled (GDPR Article 26) by, Attrecto Zrt. and Griffsoft Informatikai Zrt. (members of the Signifer Group) - together, the “Controllers”.

Attrecto Zrt. - registered seat: Leier City Center, 9024 Győr, Wesselényi St 6.; company registration number: 08-10-001846; tax number: 23717154-2-08 (HU23717154); contact email: info@attrecto.com.

Griffsoft Informatikai Zrt. - registered seat: 1041 Budapest, Görgey Artúr utca 69-71., Hungary; company registration number: 01-10-049196; tax number: 12573936-2-41; represented by: Benedek Szajbély, CEO; contact email: info@griffsoft.hu. Data Protection Officer (DPO): Becher és Torma Law Firm, email: dpo@griffsoft.hu.

2. Data processed via the contact form

Data processed: first name, last name, company name, email address, phone number (optional), the message text, and the language (Hungarian/English) the form was submitted in.

Purpose: to receive and respond to visitor enquiries, and to establish contact.

Legal basis: the data subject's voluntary consent (GDPR Article 6(1)(a)) - the form can only be submitted after checking the box confirming acceptance of this Privacy Policy.

Recipients and storage: a successfully submitted message is forwarded by email to the Controllers' designated contact address, and is also recorded on the Website's password-protected administration interface so that the Controllers can manage and track it more easily. Only the Controllers' authorised staff have access to this record.

Retention period: the Controllers retain the emailed enquiry in the contact mailbox until it has been handled, and thereafter - absent a legal obligation or legitimate interest requiring longer retention - for up to 12 months. The record kept on the Website's administration interface is not subject to a predetermined, automatic retention period - it is deleted manually, at the Controllers' discretion. In case of an invalid/incomplete submission, previously entered field values are kept in a temporary, purely technical storage (used only to repopulate the form) for a maximum of 5 minutes, after which they are automatically and permanently deleted.

3. Data processed via the careers page (job applications)

Data processed: first name, last name, email address, phone number (optional), the selected position category, any uploaded files (CV, cover letter, other materials), the content of the free-text field (optional), the language (Hungarian/English) the form was submitted in, and - if the application was started from a specific, featured job posting - the name of that job posting.

Purpose: to evaluate the submitted job application and to contact the applicant during the hiring process.

Legal basis: the data subject's voluntary consent (GDPR Article 6(1)(a)) - the application can only be submitted after checking the box confirming acceptance of this Privacy Policy.

Recipients and storage: a successfully submitted application - with any uploaded files attached - is forwarded by email to the Controllers' designated contact address, and is also recorded on the Website's password-protected administration interface (uploaded files are stored in a dedicated, non-public server directory under a randomised file name). Only the Controllers' authorised staff have access to this record.

Retention period: the Controllers retain application data and any uploaded files for up to 12 months from the closing of the hiring process, after which they are deleted. If an applicant consents to the Controllers keeping their CV on file for future, relevant openings, this consent and the associated retention period will be requested separately, in direct communication with the applicant.

4. Spam filtering and security-related processing

Rate limiting: a one-way hash derived from the submitter's IP address is stored for a maximum of 10 minutes, solely to determine whether too many submissions have arrived from the same IP address in a short period. Legal basis: the Controllers' legitimate interest in the secure operation of the service (GDPR Article 6(1)(f)).

Google reCAPTCHA: upon submission, the visitor's IP address and a verification token are sent to Google's servers for real-time bot detection. Further details (data transfer, legal basis) are described in the Cookie Policy. This applies to the careers page application form in addition to the contact form, since both use the same reCAPTCHA protection.

5. Cookies and analytics

The separate Cookie Policy provides complete, up-to-date information about the cookies used by the Website (including Google reCAPTCHA and Google Analytics 4), including how to manage and withdraw your consent.

6. Technical logging (server logs)

For technical reasons necessary to operate the Website (troubleshooting, investigating security incidents), the hosting server may automatically log certain technical data (e.g. IP address, timestamp, browser identifier). Legal basis: the Controllers' legitimate interest in the secure operation of the Website (GDPR Article 6(1)(f)).

The exact retention period of server logs depends on the hosting provider's technical configuration - the Controllers will add this once the hosting provider and the exact retention period are confirmed (see the Impressum).

7. International data transfers

Using Google's (Google Ireland Limited, and its parent company Google LLC, USA) reCAPTCHA and Google Analytics 4 services may involve transferring data to the United States. Such transfers rely on Google's own GDPR-compliant contractual safeguards (Standard Contractual Clauses). More information: https://policies.google.com/privacy

8. Data processors

Google Ireland Limited / Google LLC - provision of the reCAPTCHA and Google Analytics 4 services.

Hosting provider - technical operation of the Website (including storage of files uploaded via the careers page). The hosting provider's exact details will be added to the Impressum once available.

9. Your rights

Under the GDPR you have the right to: request access to your data (Article 15), request rectification (Article 16), request erasure (Article 17), request restriction of processing (Article 18), request data portability (Article 20), object to processing (Article 21), and - where processing is based on consent - withdraw your consent at any time without giving a reason (this does not affect the lawfulness of processing carried out before withdrawal).

To exercise your rights, or with any privacy-related question, you may contact the Controllers via the form in the “Get in Touch” section of the Website, or directly the Data Protection Officer of Griffsoft Informatikai Zrt.: dpo@griffsoft.hu.

10. Remedies

If you believe the processing violates the GDPR, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): address: 1055 Budapest, Falk Miksa utca 9-11., Hungary; postal address: 1363 Budapest, Pf.: 9., Hungary; phone: +36 (1) 391-1400; email: ugyfelszolgalat@naih.hu; website: www.naih.hu. You may also bring a claim before the competent court.

11. Data security

The Controllers apply appropriate technical and organisational measures to protect the personal data processed against unauthorised access, alteration, transmission, disclosure, deletion or destruction, as well as against accidental loss or damage.

12. Changes to this policy

The Controllers reserve the right to amend this Privacy Policy, in particular in the event of a change in applicable law or in the data processing activities carried out on the Website. Any changes will be reflected in the “Last updated” date at the top of this document.