Privacy notice
This English version is provided for information; in case of discrepancy the Hungarian version prevails.
Version: v1.3
Effective from: 26 October 2026
This notice describes how the operator of the levotech.pro website processes personal data when the website is visited, when the project calculator and the contact form are used, and in the course of enquiries by e-mail and telephone. The notice is based on Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, "GDPR") and on Act CXII of 2011 on the Right to Informational Self-Determination and on Freedom of Information (az információs önrendelkezési jogról és az információszabadságról szóló 2011. évi CXII. törvény, "Infotv.").
1. The controller
| Name | Birkás Levente, sole proprietor (egyéni vállalkozó) (brand name: LevoTech) |
|---|---|
| Registered seat | 2870 Kisbér, Szent Imre utca 52/E, Hungary |
| Registration number | 60791650 |
| Tax number | 91286372-1-31 |
| birkas.levente@levotech.pro | |
| Telephone | +36 30 846 5762 |
| Website | https://levotech.pro |
LevoTech is a trade name and not a separate legal person. The controller carries out all processing described here himself; apart from him and the processors listed in section 4, no one has access to the data.
Data protection officer. The controller has not designated a data protection officer, as he is not obliged to do so under Article 37(1) GDPR: he is not a public authority, his core activities do not consist of processing operations that require regular and systematic monitoring of data subjects on a large scale, and he does not process special categories of data or data relating to criminal convictions on a large scale. Data protection questions may be addressed directly to the controller at the contact details above.
2. Processing operations
2.1. Quote requests via the project calculator and the contact form
| Data processed | name; e-mail address; company name (optional); text of the message; the project details selected in the calculator (project type, modules, timeline, the answer given regarding the estimated price range, selection of the price freeze (Árstop) programme); the interface language; where the visitor arrived through such a link: the campaign parameters of the link (utm_source, utm_medium, utm_campaign, utm_content, utm_term, from) and the path of the first page opened; the time of submission. During the visit the website keeps the campaign parameters only in the memory of the browser tab (it does not store them on the device), and they reach the controller only if the visitor submits the form. |
|---|---|
| Purpose | answering the enquiry, preparing a quote or a project assessment, sending the requested confirmation e-mail; establishing, on the basis of the campaign parameters, where the enquiry came from |
| Legal basis | where the enquiry is sent by a private individual or a sole proprietor in their own name: steps taken at the request of the data subject prior to entering into a contract, Article 6(1)(b) GDPR. Where the enquiry is sent as a representative or employee of a company or organisation: the legitimate interest of the controller in answering the business enquiry, Article 6(1)(f) GDPR. Processing of the campaign parameters sent together with the form: the legitimate interest of the controller in knowing which link or campaign led to the enquiry, Article 6(1)(f) GDPR. The campaign parameters are kept for the same period as the other data of the quote request, 12 months. |
| Retention period | where the enquiry does not lead to a contract: 12 months from the last substantive exchange of messages, followed by erasure. Where a contract is concluded: as set out in section 2.3. |
| Source of the data | provided by the data subject; the campaign parameters are read by the browser from the URL of the link |
The submitted data are not stored in a database: the website forwards the data by e-mail to the controller's mailbox and sends an automatic confirmation to the e-mail address provided. The data are thereafter held in the controller's mailbox.
2.2. Direct enquiries by e-mail or telephone
| Data processed | name, e-mail address or telephone number, the content and time of the message, and anything else the data subject provides in the enquiry |
|---|---|
| Purpose | answering the enquiry, maintaining contact |
| Legal basis | Article 6(1)(b) GDPR (steps prior to entering into a contract) or, in the case of a company representative, point (f) (legitimate interest) |
| Retention period | as in section 2.1 |
| Source of the data | the data subject |
2.3. Conclusion and performance of contracts
| Data processed | name, address or registered seat, tax number, e-mail address and telephone number of the contracting party or its representative, data relating to the contract and its performance, names and contact details of contact persons |
|---|---|
| Purpose | concluding and performing the contract, settling the fee, enforcing claims |
| Legal basis | performance of a contract, Article 6(1)(b) GDPR; for contact persons of an organisation: legitimate interest, Article 6(1)(f) GDPR; retention after termination of the contract: legitimate interest in the establishment and defence of legal claims, Article 6(1)(f) GDPR |
| Retention period | 5 years from termination of the contract, which is the general limitation period under section 6:22(1) of Act V of 2013 on the Civil Code (a Polgári Törvénykönyvről szóló 2013. évi V. törvény, "Ptk."). In the event of pending legal proceedings, until their final conclusion. |
| Source of the data | the data subject or the contracting organisation |
Further details may also be set out in the individual contract concerned.
2.4. Invoicing and tax records
| Data processed | the data that must be shown on an invoice (customer's name, address, tax number, if any), data relating to performance and payment, the entries of the revenue records |
|---|---|
| Purpose | issuing invoices, keeping the revenue records, fulfilling tax obligations |
| Legal basis | legal obligation, GDPR Article 6(1)(c); tax legislation |
| Retention period | we keep invoices and related records for the period required by tax legislation |
| Source of the data | the data subject or the contracting organisation |
| Invoicing software | Számlázz.hu (KBOSS.hu Kft.), see section 4 |
2.5. Operation and security of the website (server logs)
| Data processed | IP address, time of the request, URL opened, browser and operating system type, referring page, error messages |
|---|---|
| Purpose | serving the website, troubleshooting, preventing abuse (for example automated mass submission of the form) |
| Legal basis | the legitimate interest of the controller in the secure and uninterrupted operation of the website, Article 6(1)(f) GDPR |
| Retention period | the IP-based submission limit keeps the address only in server memory, for no more than 60 seconds. The hosting provider (Vercel, Pro subscription) keeps runtime logs for 1 day and deletes them thereafter. |
| Source of the data | sent automatically by the visitor's browser |
2.6. Audience measurement (Vercel Web Analytics)
| Data processed | the page opened, time, referring page, the campaign parameters, country and region, device type, operating system and browser type and version; aggregated events about the use of the project calculator (which step the visitor reached, whether the price estimate was shown, whether the submission succeeded, the project type) |
|---|---|
| Purpose | aggregated, statistical measurement of the use of the website |
| Legal basis | the legitimate interest of the controller in developing the website, Article 6(1)(f) GDPR |
| Retention period | the hash derived from the request and used to identify the visitor is discarded by the provider after 24 hours. The aggregated statistics cannot be linked to any individual. |
| Source of the data | the visitor's browser |
The measurement does not use cookies, does not record names, e-mail addresses or text entered in the form, and does not track the visitor on other websites. The right to object is described in section 6.6.
2.7. Handling of consumer complaints
| Data processed | the name, home address or e-mail address of the consumer making the complaint, the description and time of the complaint, attached documents, in the case of an oral complaint the record taken, and the controller's reply |
|---|---|
| Purpose | investigating and answering the consumer complaint |
| Legal basis | compliance with a legal obligation, Article 6(1)(c) GDPR; section 17/A of Act CLV of 1997 on Consumer Protection (a fogyasztóvédelemről szóló 1997. évi CLV. törvény, "Fgytv.") |
| Retention period | the record of an oral complaint, the written complaint and the copy of the reply: 3 years (Fgytv. section 17/A(7)) |
| Source of the data | the data subject |
Information on how to make a complaint and on consumer disputes is provided in the "Complaints and consumer disputes" part of the Legal notice.
3. Whether provision of data is required
No law requires the data to be provided. The quote request form cannot be submitted without the name, e-mail address, message and project details, because without them the controller cannot reply. Providing the company name is optional. The identification data of the contracting party are needed to conclude a contract; the provision of invoicing data is based on a legal obligation.
4. Recipients and processors
The controller uses the processors listed below. They process the data solely on behalf of and on the instructions of the controller, under a data processing agreement pursuant to Article 28 GDPR. Resend's data processing agreement (Data Processing Addendum) forms part of Resend's terms of service, and the controller has accepted it by using the service.
| Processor | Task | Data concerned |
|---|---|---|
| Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States of America; privacy@vercel.com | hosting, serving the website, server logs, audience measurement | the data in sections 2.1, 2.5 and 2.6 |
| Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, United States of America; privacy@resend.com | delivery of form data and of the confirmation e-mail | the data in section 2.1 |
| Google (Google Workspace e-mail service) | the controller's e-mail system, where quote requests and direct e-mails are received | the data in sections 2.1, 2.2 and 2.3 |
| KBOSS.hu Kereskedelmi és Szolgáltató Kft. (Számlázz.hu), registered seat: 1031 Budapest, Záhony utca 7., Hungary; company registration number: 01-09-303201; tax number: 13421739-2-41; info@szamlazz.hu; data protection officer: dpo@kboss.hu | online invoicing and storage of invoices | the data in section 2.4 |
| Nueva Könyvelő és Adótanácsadó Kft., registered seat: 2230 Gyömrő, Fogarasi utca 3., Hungary; company registration number: 13-09-180053; tax number: 22781983-2-13; iroda@nueva.hu | bookkeeping, tax returns | the data in section 2.4 |
The controller does not sell the data and does not disclose them to third parties for marketing purposes. Upon a request from an authority or court based on law, the controller discloses the requested data to the extent required by law.
5. Transfers outside the European Economic Area
Vercel Inc. and Plus Five Five, Inc. (Resend) are providers established in the United States of America, so the data may also be transferred to the United States. The basis of the transfer:
- Vercel Inc.: the provider has self-certified under the EU-U.S. Data Privacy Framework, so the transfer takes place on the basis of the adequacy decision of the European Commission in Implementing Decision (EU) 2023/1795 (Article 45 GDPR). As an additional safeguard, the provider's data processing agreement also incorporates the standard data protection clauses of the European Commission (Article 46(2)(c) GDPR).
- Plus Five Five, Inc. (Resend): the provider appears on the list of participants in the EU-U.S. Data Privacy Framework (Article 45 GDPR), and its data processing agreement also incorporates the standard data protection clauses of the European Commission (Article 46(2)(c) GDPR). E-mails are sent from a sending region operating in the European Union (Ireland); account data are stored by the provider in the United States.
- Google (Google Workspace e-mail service): where data are transferred outside the European Economic Area, in particular to the United States, the basis of the transfer is the adequacy decision under the EU-U.S. Data Privacy Framework (Article 45 GDPR) or the standard data protection clauses contained in Google's data processing terms (Article 46(2)(c) GDPR).
List of Framework participants: https://www.dataprivacyframework.gov
6. Rights of the data subject
Requests to exercise the rights below may be sent to birkas.levente@levotech.pro or by post to the registered seat (2870 Kisbér, Szent Imre utca 52/E, Hungary). Where the controller has reasonable doubts concerning the identity of the requester, he may request additional information necessary to confirm identity (Article 12(6) GDPR); typically this means confirming that the request comes from the e-mail address to which the processing relates.
Time limit. The controller acts on the request without undue delay and in any event within one month of receipt, or provides information on the action taken. This period may be extended by two further months, taking into account the complexity and number of requests; the controller informs the data subject of any extension and of the reasons within one month. If the controller does not take action, he informs the data subject of the reasons and of the available remedies within one month (Article 12(3) and (4) GDPR).
Free of charge. Information and action are free of charge. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may charge a reasonable fee or refuse to act (Article 12(5) GDPR).
Notification of recipients. In the case of rectification, erasure or restriction, the controller notifies every recipient to whom the data were disclosed, unless this proves impossible or involves disproportionate effort (Article 19 GDPR).
6.1. Access (Article 15 GDPR)
The data subject may request confirmation as to whether the controller processes their personal data. If so, the data subject is entitled to access the data and the following information: the purpose of processing, the categories of data, the recipients, the retention period, the data subject's rights, the right to lodge a complaint, the source of the data, and the safeguards for transfer to a third country. On request, the controller provides a copy of the data.
6.2. Rectification (Article 16 GDPR)
The data subject may request the rectification of inaccurate data and the completion of incomplete data.
6.3. Erasure (Article 17 GDPR)
The data subject may request the erasure of their data, in particular where the data are no longer necessary for the purpose for which they were collected, where they object and there are no overriding legitimate grounds, or where the processing is unlawful. Erasure cannot be carried out where the processing is necessary for compliance with a legal obligation (for example keeping invoices) or for the establishment, exercise or defence of legal claims.
6.4. Restriction of processing (Article 18 GDPR)
The data subject may request that the controller does not process the data other than storing them, where
a) they contest the accuracy of the data, for the period of verifying accuracy;
b) the processing is unlawful but they request restriction instead of erasure;
c) the controller no longer needs the data, but the data subject requires them for a legal claim;
d) they have objected, pending the assessment of the objection.
6.5. Data portability (Article 20 GDPR)
Where the processing is based on a contract or consent and is carried out by automated means, the data subject is entitled to receive the data they provided in a structured, commonly used and machine-readable format (for example CSV or JSON), and may request their direct transmission to another controller where technically feasible.
6.6. Objection (Article 21 GDPR)
The data subject may object at any time, on grounds relating to their particular situation, to processing based on legitimate interest (enquiries by company representatives and campaign parameters under section 2.1, retention under section 2.3, sections 2.5 and 2.6). In that case the controller no longer processes the data, unless he demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or which relate to the establishment, exercise or defence of legal claims. On request, the data subject is informed of the outcome of the balancing test relating to the legitimate interest.
6.7. Withdrawal of consent (Article 7(3) GDPR)
The website currently carries out no processing based on consent. If consent is requested in the future (for example for advertising measurement), the data subject may withdraw consent at any time, as easily as it was given. Withdrawal does not affect the lawfulness of processing before withdrawal.
6.8. Automated decision-making (Article 22 GDPR)
The controller does not use automated decision-making, including profiling. The price range shown by the project calculator is an indicative estimate calculated from the selected parameters; it is not a decision producing legal effects concerning the data subject.
7. Cookies and data stored in the browser
The website uses the following technical solution necessary for its operation:
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| NEXT_LOCALE | cookie, first-party | remembering the selected language (Hungarian or English) | until the browser is closed |
Apart from this, the website does not store any data on the visitor's device. It keeps the campaign parameters (section 2.1) only in the memory of the browser tab for the duration of the visit; they are lost on a full reload or when the tab is closed.
Vercel Web Analytics does not use cookies (section 2.6). There is no advertising or social media tracking code on the website. Details are set out in the Cookie notice: https://levotech.pro/en/cookies.
8. Data security
The controller applies appropriate technical and organisational measures proportionate to the risks (Article 32 GDPR), in particular access restriction, encrypted connections (HTTPS) and password-protected accounts. Within this:
- the website and the form are available only over an encrypted (HTTPS/TLS) connection;
- the website does not store form data in a database, it only forwards them by e-mail;
- the form applies protection against abuse (hidden honeypot field, IP-based submission limit);
- only the controller has access to the e-mail, hosting and invoicing accounts, through password-protected access;
- the processors have undertaken their own security measures in the data processing agreement.
9. Personal data breaches
If an incident affecting personal data (for example unauthorised access or data loss) occurs, the controller records it and, where the incident is likely to result in a risk to the rights and freedoms of data subjects, notifies it without undue delay and, where feasible, within 72 hours to the Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information) (Article 33 GDPR). Where the incident is likely to result in a high risk, the controller also informs the data subjects (Article 34 GDPR).
10. Minors
The services of the website are intended for businesses and adult private individuals, not for children. The controller does not knowingly collect data of persons under 16. If he becomes aware that a person under 16 has submitted data, he deletes them.
11. Remedies
Complaint to the supervisory authority. The data subject may lodge a complaint with the supervisory authority of the Member State of their habitual residence, place of work or place of the alleged infringement (Article 77 GDPR). In Hungary this is:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH; Hungarian National Authority for Data Protection and Freedom of Information)
Registered seat: 1055 Budapest, Falk Miksa utca 9-11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
Telephone: +36 1 391 1400
E-mail: ugyfelszolgalat@naih.hu (according to the Authority, proceedings cannot be initiated by e-mail)
Website: https://naih.hu
Judicial remedy. The data subject may bring an action before a court if they consider that the controller or the processor processes their personal data in breach of the law (Article 79 GDPR, Infotv. section 23). The controller bears the burden of proving the lawfulness of the processing. The action falls within the competence of the regional court (törvényszék); at the data subject's choice, the action may also be brought before the regional court competent for their home address or place of residence. List and contact details of the regional courts: https://birosag.hu
Compensation and restitution for non-pecuniary damage. Any person who has suffered damage or a violation of personality rights as a result of unlawful processing is entitled to compensation or to restitution for non-pecuniary damage (sérelemdíj) (Article 82 GDPR).
The controller recommends that, before lodging a complaint, the data subject contacts him directly so that the issue can be resolved quickly. This is not a precondition for turning to the authority or a court.
12. Amendments to this notice
The controller may amend this notice if the operation of the website, the range of processors or the law changes. The controller publishes the amended notice on the website, stating its effective date. If the amendment materially affects the processing of data already submitted, the controller also informs the data subject at the known e-mail address.
Version: v1.3
Effective from: 26 October 2026