# Privacy notice

> What data we process, why and for how long.

URL: https://static.223.66.31.2.clients.your-server.de/en/privacy
Last updated: 2026-10-25

**Draft.** Bracketed values must be filled in from the real business registration, and the text should be checked by a lawyer before launch.

## Who controls your data?

The controller is [business name] ([address], [hello@domain]). Appointing a data protection officer is not required.

## What data, why and for how long?

- **Contact form and Twenty CRM** — name, email, company, message, language, time. Legal basis: GDPR Art. 6(1)(b) / (f), replying to your enquiry. Retention: [e.g. 1 year after last contact].
- **Notification email** — the same data, in an email to the operator. Legal basis and retention: as above.
- **Statistics (Google Analytics 4), consent only** — pseudonymous IDs, usage events, approximate location, device data. Legal basis: GDPR Art. 6(1)(a), consent. Retention: [14 months].
- **Server logs** — IP address, browser, time, URL. Legal basis: GDPR Art. 6(1)(f), security and operation. Retention: [30 days].
- **Spam protection** — IP address (hashed where possible). Legal basis: GDPR Art. 6(1)(f). Retention: [24 hours].

## Who has access?

- Hetzner Online GmbH — hosting (EU)
- Google Ireland Ltd. — Google Analytics 4, only with consent; data may be transferred to Google LLC (US) under the EU–US Data Privacy Framework
- [email provider] — notification emails

Enquiries are stored in a self-hosted Twenty CRM on the same hosting. We don't sell data and there's no automated decision-making.

## Your rights

You can request access, correction, erasure or restriction, object, ask for portability, and withdraw consent at any time via “Cookie settings” in the footer. You can complain to the Hungarian data protection authority (NAIH, naih.hu) or a court.