Data Protection & Privacy Policy
Information on personal data processing in accordance with Regulation (EU) 2016/679 (GDPR) and Act CXII of 2011 (Infotv.)
1. Data Controller Information
Artraco Kft. (hereinafter: 'Controller' or 'Company') operates the website artraco.com and processes personal data strictly in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation - GDPR) and relevant domestic legislation (Act CXII of 2011 on Informational Self-Determination and Freedom of Information - Infotv.).
Artraco Kft.
1118 Budapest, Hungary
Registered at Budapest Metropolitan Court
Tax ID: HU registered corporate entity
2. Principles of Data Processing
The Controller processes all personal data in accordance with the core principles set out in Article 5 of the GDPR:
Lawfulness, Fairness and Transparency
Personal data is processed lawfully, fairly, and in a transparent manner in relation to the data subject.
Purpose Limitation
Data is collected solely for specified, explicit, and legitimate purposes and not processed in an incompatible manner.
Data Minimization
Processing is limited strictly to data that is adequate, relevant, and necessary for the stated purposes.
Accuracy
Personal data is kept accurate and up to date; inaccurate data is rectified or erased without delay.
Storage Limitation
Data is retained in an identifiable form for no longer than is necessary for the purposes of processing.
Integrity and Confidentiality
Data is processed with technical and organizational safeguards against unauthorized processing, loss, or destruction.
3. Scope, Purpose & Legal Basis of Data Processing
A. Project Inquiries & Request for Proposals
When submitting a project inquiry via our online builder, we process: Full name, work email address, company name, phone number (optional), project specifications, timeline, budget range, and any attached documentation (specifications, wireframes, RFP documents).
Purpose: Evaluating technical project feasibility, preparing proposals, communicating with prospective clients, and taking steps prior to entering into a contract.
Legal Basis: GDPR Article 6(1)(b) (processing necessary to take steps at the request of the data subject prior to entering into a contract) and GDPR Article 6(1)(a) (explicit consent for voluntary data).
Retention Period: Inquiries not resulting in a contract are retained for up to 2 years for subsequent project discussions or until consent is revoked, after which data and attachments are permanently deleted.
B. Server Log Files & IT Security
When accessing our web platform, our infrastructure automatically records technical access logs: IP address, request timestamp, HTTP method, requested URL, user agent string, and HTTP status code.
Legal Basis: GDPR Article 6(1)(f) (legitimate interest in maintaining network resilience, troubleshooting faults, and preventing cyber attacks).
Retention Period: Server access logs are rotated and permanently purged within 30 days.
4. Cookies & Local Storage
Our website utilizes cookies and browser local storage to maintain session reliability, preserve user preferences (such as language selection), and store cookie consent choices. We do not use third-party behavioral advertising trackers.
Strictly Necessary Cookies & Storage
Essential for site security, network accessibility, language persistence (NEXT_LOCALE), and consent tracking (artraco_cookie_consent). Lawful basis: GDPR Article 6(1)(f).
Performance & Functional Metrics
Optional technical metrics to evaluate platform responsiveness and system performance. Placed only upon user consent (GDPR Article 6(1)(a)).
5. Data Processors & Hosting Infrastructure
Personal data is processed on secure servers located within the European Union. We do not sell, rent, or transfer personal data to unauthorized third parties or third countries outside the EEA.
Kerio Connect Mail Infrastructure
Enterprise mail server handling secure SMTP delivery of project inquiries
Cloud Hosting & Ingress Tier
Containerized application runtime, Traefik reverse proxy, SSL/TLS termination
6. Technical & Organizational Security Measures
Artraco Kft. enforces robust security protocols to safeguard personal data against unauthorized disclosure, alteration, destruction, or interception:
Strict TLS 1.3 / HTTPS encryption for all in-transit web communication.
Authenticated SMTP with STARTTLS / SSL encryption for inquiry dispatch via Kerio Connect.
Isolated Docker container environments and restricted server access with SSH public key authentication.
Strict client-side and server-side file sanitization blocking dangerous executable file extensions (.exe, .bat, .cmd, .sh, .msi, etc.) and enforcing 10MB capacity thresholds.
Continuous dependency security scanning and automated container vulnerability verification.
7. Your Rights as a Data Subject
Under Articles 15-22 of the GDPR, you have the following enforceable rights regarding your personal data:
Right of Access (Art. 15)
You have the right to obtain confirmation as to whether or not your personal data is being processed, and receive a copy of such data.
Right to Rectification (Art. 16)
You have the right to request the rectification of inaccurate personal data without undue delay.
Right to Erasure / 'Right to be Forgotten' (Art. 17)
You have the right to obtain the erasure of your personal data where the data is no longer necessary or consent has been withdrawn.
Right to Restriction of Processing (Art. 18)
You may request the restriction of data processing in cases defined by law (e.g. while data accuracy is contested).
Right to Data Portability (Art. 20)
You have the right to receive personal data you provided in a structured, commonly used, and machine-readable format.
Right to Object (Art. 21)
You have the right to object at any time to the processing of your personal data based on legitimate interests.
Right to Withdraw Consent (Art. 7(3))
Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.
8. Legal Remedies & Supervisory Authority
If you believe that your personal data has been processed in violation of data protection regulations, we encourage you to contact us first at info@artraco.com so we can resolve the matter immediately. You also have the right to lodge a formal complaint with the competent supervisory authority or seek judicial remedy before a court:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
Email: ugyfelszolgalat@naih.hu
Website: https://naih.hu
Phone: +36 (1) 391-1400
You are also entitled to initiate court proceedings against the Controller in accordance with GDPR Article 79 and Section 22 of the Infotv. Such proceedings may be brought before the competent regional court (Törvényszék) of the Controller's registered seat or, at your choice, the regional court of your domicile or residence.