Privacy Notice
Effective from: 9 October 2026
1. The data controller
| Name | System Lab |
|---|---|
| info@systemlab.hu | |
| Phone | +36 30 090 8934 |
| Website | https://systemlab.hu |
| Registered office | Budapest, Hungary |
2. What data we process and why
2.1 Contact and booking
When you book an appointment or get in touch with us, we process the following data: name, company name, email address, phone number, the topic you chose and the message you wrote. The system automatically adds which page you came from, through which link, the language you viewed the site in, and your browser identifier. We send our emails in the language you viewed the site in (Hungarian or English).
- Purpose: getting in touch, confirming the booked appointment and sending related reminders, making an offer.
- Legal basis: your consent (GDPR Art. 6(1)(a)) and steps taken before concluding a contract (Art. 6(1)(b)).
- Retention: until consent is withdrawn, but for no more than 24 months. If a contract is concluded, for the period required by law.
2.2 Requesting the self-assessment
If you request the self-assessment, we process your first name, your email address and the main problem you indicate.
- Purpose: sending the material, and a few related, useful messages during the following week.
- Legal basis: your consent (GDPR Art. 6(1)(a)).
- Retention: until consent is withdrawn, but for no more than 24 months.
2.3 Unsubscribing from automated emails
Every automated email from us has an unsubscribe link at the bottom. If you unsubscribe, we store your email address and the time of unsubscribing on an unsubscribe list, so that no more automated emails (reminders, follow-ups) go to that address.
- Purpose: respecting your decision to unsubscribe.
- Legal basis: legitimate interest (GDPR Art. 6(1)(f)).
- Retention: until you consent to emails again (for example with a new booking or material request, or by reversing it on the unsubscribe page), or until you ask for its deletion.
2.4 Calendar event
When you book, we also record your name, company name and email address as a calendar event and send you the invitation. You can delete the event at any time with the cancellation link.
2.5 Log data
For technical reasons, the hosting provider may log your IP address, browser identifier and the time of your visit.
- Purpose: operation, security, preventing abuse.
- Legal basis: legitimate interest (GDPR Art. 6(1)(f)).
- Retention: according to the provider's settings, typically 30 days.
2.6 Client relationship records
We keep incoming inquiries, bookings and our correspondence with you in our own password-protected customer relationship system (CRM), so that no question gets lost and we know where your case stands.
- Data processed: the name, company name, email address and phone number provided, the need described, the emails exchanged with us, agreed appointments, and offers sent to you and their status.
- Purpose: answering your inquiry, preparing an offer and contract, then managing the client relationship.
- Legal basis: steps before concluding a contract and performance of a contract (GDPR Art. 6(1)(b)), otherwise legitimate interest in answering your inquiry (GDPR Art. 6(1)(f)).
- Retention: 5 years from the end of the client relationship, or if no engagement resulted, 2 years from the last substantive contact.
- Where: the system runs on Cloudflare's European infrastructure, and only a few named System Lab staff members can access it, with individual usernames and passwords.
3. Cookies, local storage and visitor measurement
For its basic operation, the website uses your browser's local storage: it remembers the language you selected, and during booking it temporarily stores the data you entered until you reach the calendar page. The latter is deleted when the booking is completed. This data does not leave your browser.
3.1 Our own cookie-free measurement
We measure how the site is used: which pages are viewed, where people click, how far they scroll and which source they came from. For this we do not use cookies and do not store IP addresses. We tell visitors apart with a technical identifier that is re-salted daily and cannot be reversed. It gives a different value the next day, so the same visitor cannot be traced across days. We record your browser type only as a category (mobile or desktop, operating system, browser name). We do not store parameters passed in the address bar (query string).
- Purpose: improving how clear and usable the website is, and understanding which marketing channel works.
- Legal basis: legitimate interest (GDPR Art. 6(1)(f)). Since the measurement uses no cookies and stores no personal data, prior consent is not needed, which is why no cookie pop-up appears.
- Retention: detailed events for 120 days, anonymous summaries made from them for longer.
- Turning it off: with the Turn off analytics link at the bottom of the page, at any time, immediately, without giving a reason.
If you fill in one of the forms, that visit is linked to the email address you provided, so we can see which channel the inquiry came from. Otherwise the measurement data stays anonymous.
3.2 Google Analytics in cookie-free mode
For long-term statistics we may also use the Google Analytics 4 tag. We start it with storage denied (Google Consent Mode v2, analytics_storage: denied), so it places no cookies in your browser and creates no persistent identifier. It only sends anonymous, aggregated signals. No measurement for advertising and no profiling takes place.
- Legal basis: legitimate interest (GDPR Art. 6(1)(f)), as no cookies are stored.
- Turning it off: the same Turn off analytics link at the bottom of the page stops this too.
If we want to measure more than this in the future, we will only do so with your express consent, and we will ask you again.
4. Who we share your data with
The following providers can access your data, only to the extent needed to provide their service:
| Provider | Role | Place of processing |
|---|---|---|
| Cloudflare, Inc. | Website hosting and delivery, and the DNS service. For technical reasons it logs basic visit data (IP address, browser identifier) | EU and USA, under standard contractual clauses |
| Zoho Corporation B.V. | Handling and storing email sent to and from systemlab.hu addresses | EU (European data center) |
| Google Ireland Ltd. | Running the booking system, storing incoming data (Sheets, Drive), managing calendar events, sending emails | EU, and the USA under the EU-US Data Privacy Framework |
| Cloudflare, Inc. | Running the customer relationship system (CRM) and its database, where your inquiry and our correspondence are stored | EU (European data center), under standard contractual clauses |
| Google Ireland Ltd. | Visitor statistics (Google Analytics 4), in cookie-free, storage-denied mode. It creates no persistent identifier | EU, and the USA under the EU-US Data Privacy Framework |
| Google Ireland Ltd. (Gemini) | The internal assistant of the CRM, used only by our staff. It receives data only when a staff member asks a specific question, and then data about the client concerned may be passed on. On the paid tier, the provider does not use the data to train models. No AI writes the emails sent to you: automated emails come from pre-written templates | EU, and the USA under the EU-US Data Privacy Framework |
For transfers to third countries, we apply the appropriate safeguards under the GDPR (adequacy decision or standard contractual clauses).
5. Use of artificial intelligence
The automated emails sent to you are not written by AI. They come from pre-written templates, and the only personalization is addressing you by your first name.
Our internal customer relationship system does have an AI assistant, used only by our staff: we can ask it about our own data, and it helps us phrase replies. It receives data only when one of us asks it a specific question. No automated decisions are made about you, and we do no profiling: every substantive decision is made by a person.
We also use AI-based solutions in client projects. In those cases we pass on only the data needed for the task, and the details of the processing are set out in a separate data processing agreement with the client.
6. Your rights
- Access: you can ask what data of yours we process.
- Rectification: you can ask us to correct inaccurate data.
- Erasure: you can ask us to delete your data if we have no other legal basis for processing it.
- Restriction and objection: you can ask us to restrict processing, and object to processing based on legitimate interest.
- Data portability: you can ask for your data in a machine-readable format.
- Withdrawing consent: at any time, with effect for the future.
You can make a request using the contact details above: by email at info@systemlab.hu or by phone on +36 30 090 8934. We respond within 30 days at the latest.
Every automated email from us has an unsubscribe link at the bottom: if you click it, we send no more automated emails to that address. Booking emails also contain a cancellation link, which stops the appointment and the related data processing.
7. Remedies
You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information:
NAIH, 1055 Budapest, Falk Miksa utca 9–11. ·
naih.hu ·
ugyfelszolgalat@naih.hu
You can also go to court, at the regional court for your place of residence or stay.
8. Data security
The website is available over an encrypted (HTTPS) connection. We store incoming data in access-restricted accounts, on devices protected by two-step verification. Access keys for the system are stored on the server side only, and the website's source code contains no secrets.
9. Changes to this notice
We may change this notice at any time. The current version is always available on this page, along with its effective date.
Data stored in your browser
The contents of the Shop cart and the booking steps are stored by your browser, and do not reach us until you send the booking or request. The "Ask" assistant runs in your browser, and your question does not reach us. System Lab acts as the data controller.