Privacy Notice

Effective from 12 October 2026

Novacon Zrt. (the Controller) is committed to protecting the personal data of its website visitors, partners and clients. This notice explains in plain terms how we process your personal data and what rights you have under Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Hungarian law.

1. Data controller

• Full name: Novacon Tanácsadó Zártkörűen Működő Részvénytársaság
• Short name: Novacon Zrt.
• Registered office: 1048 Budapest, Tófalva u. 11. B/5, Hungary
• Company registration number: 01-10-142403
• Tax number: 25425527-2-41
• Email: info@novacon.hu
• Phone: +36 1 442 4044
• Website: novacon.hu

We are not required to appoint a data protection officer. For any data protection question, please contact us at info@novacon.hu.

2. Scope of this notice

This notice explains how we process personal data on the novacon.hu website (English and Hungarian pages), when you contact us, and when we work with the contact persons of our clients and partners.

It does not cover data we process in our clients’ systems on their behalf under a client contract (section 3.4). In those cases the client is the controller and Novacon acts as a processor.

3. What data we process, why and for how long

3.1. Contact requests (contact form, email, phone)

• Data: name, job title, company, business email address, phone number (optional), the topic you select, your message and the time it was sent.
• Purpose: to answer your enquiry, arrange a demo or an expert call, and prepare a proposal.
• Legal basis: your consent, given by ticking the consent box when you submit the form. You can withdraw it at any time; this does not affect the lawfulness of processing before withdrawal.
• Retention: until you withdraw your consent, but no longer than 1 year after the matter is closed. If a contract follows, we keep the data as described in section 3.3.
• Storage: we receive your message by email and also keep a copy in the website’s database, so that it is not lost if an email fails to arrive. The plugin that sends the website’s emails keeps a log of them (recipient, subject, content, time sent) in the website’s database for 90 days so that we can investigate delivery problems; the log is then deleted automatically.
• Without the required fields we cannot answer your enquiry.

3.2. Quick Assessment (online self-assessment)

This section applies when the questionnaire is available on the website.

• Data: name, job title, company, business email address, your answers to the questionnaire, the score calculated from them and the time of completion.
• Purpose: to prepare and send your assessment and, at your request, to discuss the results.
• Legal basis: your consent, given when you submit the questionnaire.
• Retention: until you withdraw your consent, but no longer than 2 years after completion. After that we use results only in anonymised, aggregated form from which you cannot be identified.
• Storage: in the website’s database.
• Automated decision-making: your score is calculated automatically from your answers, but it has no legal or similarly significant effect on you, so it is not automated decision-making under Article 22 GDPR.

3.3. Contracts and the contact persons of clients and partners

• Data: name, job title, email address and phone number of the contracting party and its contact persons; contract and invoicing details.
• Purpose: concluding and performing consulting, training, organisational development and implementation contracts; communication; invoicing.
• Legal basis: performance of a contract or steps taken before entering into a contract (point (b)); for accounting records, a legal obligation (point (c)); for contact persons named by the client, our legitimate interest in performing the contract (point (f)).
• Retention: 5 years after the contract ends (the general limitation period under the Hungarian Civil Code); accounting records for 8 years (Section 169 of the Hungarian Accounting Act).

3.4. Data in client systems during projects

In our implementation and consulting projects, client systems (for example SAP) may contain personal data. We process such data only as a processor, under the client contract and the client’s instructions. The client decides the purpose and means of processing and is responsible for informing the people concerned. Our staff and subcontractors are bound by confidentiality.

3.5. Website operation, security and spam protection

• Data: IP address, browser and device type, time of visit, the address of the page opened (server logs).
• Purpose: to keep the website secure and to filter out attacks and spam form submissions. We use Cloudflare for this (section 4).
• Legal basis: our legitimate interest in protecting the website and its visitors (point (f)).
• Retention: per the log retention of the hosting and security providers.
• You can object to processing based on legitimate interest at any time (section 7).

3.6. Cookies

To keep the website working smoothly, we place small data files called cookies in your browser.

• Strictly necessary cookies: needed for the website to work, to remember your language, for security filtering and to store your cookie choice. We do not ask for consent for these (Section 155(4) of the Hungarian Electronic Communications Act). The GDPR Cookie Compliance plugin stores your cookie choice in its own cookie (moove_gdpr_popup), so you do not have to choose again on every visit.
• Analytics cookies (Google Analytics): loaded only with your consent, after your choice in the cookie banner. They measure visits in anonymised form, for example how long visitors stay and which pages they open. You can change or withdraw your consent at any time in the cookie settings. [TO VERIFY: whether Google Analytics 4 is in use, and the exact cookie list]
• You can also delete or block cookies in your browser settings; this may affect some website functions.

4. Processors and recipients

We do not share personal data with third parties for marketing or commercial purposes. The providers below may access data as processors, acting on our instructions.

Where the law requires it (for example at the request of an authority or court), we may disclose data to the body entitled to receive it.

5. Transfers outside the European Economic Area

Some providers listed in section 4 (Google, Microsoft, Cloudflare) may process data in the United States. Such transfers rely on the European Commission’s adequacy decision (EU) 2023/1795 for companies certified under the EU–US Data Privacy Framework or, where that does not apply, on the standard contractual clauses adopted by the European Commission.

6. Data security

We treat the confidential information and business secrets entrusted to us by our clients with particular care. To protect them, we apply the following technical and organisational measures:

• Access control: only staff and subcontractors who need personal or confidential data for their work can access it.
• Confidentiality: all our staff and contributors work under a confidentiality obligation.
• IT security: we store data in password-protected, access-restricted and regularly updated systems; the website and its forms use an encrypted (HTTPS) connection.

7. Your rights

• Access: you can ask whether we process data about you, for what purpose, and request a copy (Article 15 GDPR).
• Rectification: you can ask us to correct or complete inaccurate data (Article 16).
• Erasure: you can ask us to delete your data where there is no other legal basis for keeping it, for example after you withdraw consent (Article 17).
• Restriction: you can ask us to restrict processing if you contest the accuracy of the data or the lawfulness of processing (Article 18).
• Data portability: you can request data processed on the basis of consent or contract in a machine-readable format (Article 20).
• Objection: you can object to processing based on legitimate interest (Article 21).
• Withdrawing consent: at any time, without giving reasons; this does not affect the lawfulness of earlier processing (Article 7(3)).

Please send your request to info@novacon.hu. We respond free of charge within one month at the latest; where justified, this can be extended by two further months, in which case we will let you know (Article 12(3)).

8. Complaints and remedies

If you have a concern about how we handle your data, please tell us first at info@novacon.hu, so that we can look into it promptly. You can also lodge a complaint with the Hungarian supervisory authority:

National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9–11, Hungary
Postal address: 1363 Budapest, Pf. 9.
Email: ugyfelszolgalat@naih.hu
Phone: +36 1 391 1400
Website: naih.hu

If you live or work in another EU member state, you can also complain to the supervisory authority there (Article 77 GDPR). You also have the right to go to court; in Hungary you may bring the case before the regional court of your place of residence or stay.

9. Applicable law

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)
• Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information
• Hungarian Act V of 2013 on the Civil Code
• Hungarian Act C of 2000 on Accounting
• Hungarian Act C of 2003 on Electronic Communications

10. Effective date and changes

Effective from: 12 October 2026. The previous version was effective from 5 July 2026.

We update this notice when needed; the current version is always available on this page. This notice is also available in Hungarian; in case of any discrepancy, the Hungarian version prevails.