PRIVACY

Privacy notice

Effective September 28, 2026.

This English translation is provided for convenience only. The Hungarian version is the legally binding one.

1. Who controls your data

Data controller: ZenRock Labs Korlátolt Felelősségű Társaság (ZenRock Labs Kft.), registered office: 1138 Budapest, Népfürdő utca 22. B torony, 15. emelet, company registration number: 01 09 403289, tax number: 32025909-2-41, represented by Péter Miklovicz, Managing Director. Contact: [email protected]. We are not required to appoint a data protection officer, and we have not appointed one. This notice governs the processing of personal data on the zenrock.hu website.

2. What data we process, and why

Booking a call. If you book a time on the website, we use your name, your email address, and any other information you provide to arrange the call. Legal basis: steps taken at your request prior to entering into a contract, GDPR Article 6(1)(b).

AI Maturity Quiz. The quiz runs in your browser. We do not send the results to ourselves or store them on a server, unless you choose to send them to us.

Email. If you write to us, we keep the correspondence until we have answered your inquiry and closed any matter arising from it. Legal basis: legitimate interest, GDPR Article 6(1)(f).

3. Who has access

Our data processors:

• Cloudflare, Inc. (USA): hosting and security for the website. It processes the log data technically required to serve the site, including IP addresses.
• Cal.com, Inc. (USA): operating the booking calendar. The information you enter when booking is shared with it.
• Google Ireland Ltd. (Ireland): operating Google Analytics, and only with your consent.
• DotRoll Kft. (Hungary): hosting the [email protected] mailbox.

Transfers of data to the United States are based on the EU-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses.

4. Cookies, analytics, and advertising

The website does not need cookies to work. We serve our fonts from our own server, so simply opening the site does not send any data to third parties.

Analytics, only with your consent. We would like to know how many people read the site and what they are interested in. For this we use Google Analytics 4, which places cookies in your browser. This measurement is OFF by default: the tracking code only loads if you click Accept on the pop-up banner. If you decline or make no choice, no tracking code runs at all. Legal basis: your consent, GDPR Article 6(1)(a).

Advertising. If we run an advertising campaign, advertising measurement may also be switched on based on your consent, so we can see which ads bring in genuinely interested visitors. This is tied to the same consent.

You can change your choice at any time by clicking Cookie settings in the footer. Your choice is stored by your browser, not by our server.

The booking calendar is loaded from Cal.com, and only when you scroll to the booking section. At that point, your browser connects to Cal.com's servers. This is necessary for booking to work.

5. How long we keep data

We keep booking and correspondence data for 5 years after the matter is closed. This is the general limitation period under Hungarian civil law, in other words, as long as a claim could still arise from the matter. We keep contracts and accounting records for 8 years, as required by Act C of 2000 on Accounting. We keep the fact and date of your consent for as long as we need to be able to prove that our measurement was lawful. If your inquiry does not turn into a matter, we delete the correspondence after 1 year.

6. Your rights

These rights come from Chapter III of the GDPR, and you can exercise any of them by writing to [email protected]. You don't need to give a reason, and you don't need to fill out a form.

• Access. You can ask whether we process any data about you and, if so, what data, for what purpose, for how long, and who we have shared it with. You can also request a copy.
• Rectification. If we have something wrong about you, we will correct it. If your data is incomplete, we will complete it.
• Erasure. You can ask us to delete your data. We will do so, unless the law requires us to keep it, for example in the case of accounting records.
• Restriction of processing. If you dispute the accuracy of your data, or you have objected to its processing, you can ask us not to use it until the question is resolved.
• Data portability. We will provide the data you gave us in a machine-readable format and, if you ask, transfer it to another controller.
• Objection. You can object to processing based on legitimate interest. If the processing is for direct marketing, we will stop immediately after your objection, without requiring a reason.
• Withdrawing consent. Where processing is based on your consent, you can withdraw it at any time. For analytics, simply use Cookie settings in the footer. Withdrawal does not affect the lawfulness of processing carried out before it.

7. How quickly we respond

We respond to your request without undue delay, and in any case within 1 month of receiving it. If the request is complex, this deadline can be extended by 2 months, but we will tell you why within the first month. If we decide not to take action, we will also tell you within one month, along with the reason and where you can turn.

8. How we protect your data

The website is only available over an encrypted connection. We keep our email and booking data in accounts protected by passwords and two-factor authentication, and only the people who need them for their work can see them. We do not keep personal data on paper. Every provider we use is contractually bound by data processor obligations.

We do not send personal data to any tool or service that is not listed in section 3.

9. If a data breach does occur

If an incident occurs that is likely to pose a risk to your rights, we will report it to the Hungarian National Authority for Data Protection and Freedom of Information within 72 hours of becoming aware of it. If the incident poses a high risk to you, we will also inform you directly, in plain language: what happened, what data is affected, what we have done, and what we recommend you do. We keep an internal record of incidents even when there is no obligation to report them.

10. Complaints and remedies

If you feel we are not handling your data properly, please write to us first at [email protected], because most questions can be cleared up with a single email. Regardless, you can file a complaint with the supervisory authority or go to court at any time.

• Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH). 1055 Budapest, Falk Miksa utca 9-11. Mailing address: 1363 Budapest, Pf. 9. Phone: +36 1 391 1400. Email: [email protected]
• Going to court. You can also bring a lawsuit before the regional court for your place of residence or place of stay, not only before the court for our registered office.

11. What we don't do

We are spelling this out because staying silent here could be misunderstood.

• We do not sell or rent out data. The only third parties that receive data are the processors listed in section 3, and only for the purposes listed there.
• No automated decision-making and no profiling. Decisions about you are made by people, and the website does not place you in any segment.
• No newsletter. If we ever start one, it will require separate, prior consent, and this notice will be updated first.
• No social media trackers. The site has no Facebook, LinkedIn, or other social media pixel.
• We do not process special categories of data (health, religion, political opinions, biometric data), and we do not ask for them.
• This site is not intended for children. We do not knowingly collect data from anyone under 16.

12. Our internal assistant and Google account data

For our internal work we use our own AI assistant ("Zeno MCP"). It connects only to our own team's Google accounts, with the explicit permission of the account owner. Our clients and website visitors do not sign in with it, and it has no access to their Google accounts.

• What it can access. The account owner's Gmail messages, Google Calendar and Google Drive files, only with the permissions the owner granted when signing in.
• What it uses the data for. Only for tasks the account owner asks for: reviewing and summarising emails and calendar events, reading and editing documents, and sending emails with the owner's approval.
• Where it is processed. The assistant runs on our own computer. The text needed to complete a task is processed by our artificial intelligence provider (Anthropic).
• What it does not do. We do not share or sell the data, we do not use it for advertising, and we do not use it to develop or train generalised AI models. A person may look at the data only at the account owner's request, for security reasons, or where the law requires it.
• Google's rules. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Revoking access. Access can be revoked at any time in the Google account settings (myaccount.google.com/permissions). On request, we delete the stored access keys and copies.

This notice describes how the website works today. If we turn on a new tool, this text will be updated first.