Privacy notice
Effective: 9 October 2026 · Magyar változat
This is an English translation for information. If the two versions differ, the Hungarian version prevails.
1. The data controller
| Name | System Lab |
|---|---|
| info@systemlab.hu | |
| Phone | +36 30 090 8934 |
| Website | https://systemlab.hu |
| Registered office | Budapest, Hungary |
2. What data we process and why
2.1 Getting in touch and booking a call
When you book a call or get in touch with us, we process the following data: name, company name, email address, phone number, the topic you chose, and the message you wrote. The system automatically adds which page you came from, through which link, which language you viewed the site in, and your browser's identifier. We send our emails in the language you viewed the site in (Hungarian or English).
- Purpose: getting in touch, confirming the booked call and sending reminders about it, preparing an offer.
- Legal basis: your consent (GDPR Article 6(1)(a)), and steps taken before entering into a contract (Article 6(1)(b)).
- Retention: until you withdraw your consent, but for no longer than 24 months. If a contract is concluded, for the period required by law.
2.2 Requesting the self-assessment guide
If you request the self-assessment guide, we process your first name, your email address and the main problem you selected.
- Purpose: sending you the guide, and a few related, useful messages during the following week.
- Legal basis: your consent (GDPR Article 6(1)(a)).
- Retention: until you withdraw your consent, but for no longer than 24 months.
2.3 Unsubscribing from automatic emails
Every automatic email we send has an unsubscribe link at the bottom. If you unsubscribe, we keep your email address and the time of unsubscribing on a suppression list, so that no more automatic emails (reminders, follow-ups) are sent to that address.
- Purpose: respecting your decision to unsubscribe.
- Legal basis: legitimate interest (GDPR Article 6(1)(f)).
- Retention: until you consent to our emails again (for example by booking a new call, requesting the guide again, or undoing it on the unsubscribe page), or until you ask us to delete it.
2.4 Calendar event
When you book, we also record your name, company name and email address as a calendar event, and send you the invitation. You can delete the event at any time with the cancellation link.
2.5 Log data
For technical reasons, the hosting provider may log your IP address, browser identifier and the time of your visit.
- Purpose: operation, security, preventing abuse.
- Legal basis: legitimate interest (GDPR Article 6(1)(f)).
- Retention: according to the provider's settings, typically 30 days.
2.6 Customer relationship records
We keep the enquiries and bookings we receive, and the emails we exchange with you, in our own password-protected customer relationship management system (CRM), so that no question gets lost and we know where your matter stands.
- Data processed: the name, company name, email address and phone number you gave, the need you described, the emails exchanged with us, the agreed appointments, and the quotes we sent you and their status.
- Purpose: answering your enquiry, preparing an offer and a contract, and then managing the customer relationship.
- Legal basis: steps taken before entering into a contract, or performance of a contract (GDPR Article 6(1)(b)); failing that, legitimate interest in answering your enquiry (GDPR Article 6(1)(f)).
- Retention: 5 years from the end of the customer relationship; if no assignment resulted, 2 years from the last meaningful contact.
- Where: the system runs on Cloudflare's European infrastructure, and only a few named System Lab staff members have access, each with their own username and password.
3. Cookies, local storage and analytics
For the site's basic functions your browser's local storage is used: it remembers the language you chose, and while you book a call it temporarily stores the details you entered until you reach the calendar page. The latter is deleted when the booking is completed. This data never leaves your browser.
3.1 Our own, cookieless analytics
We measure how the site is used: which pages are viewed, where people click, how far they scroll, and which source they came from. We do not use cookies for this and do not store IP addresses. Visitors are told apart by a technical identifier that is re-salted daily and cannot be reversed; the next day it gives a different value, so the same visitor cannot be followed across days. Your browser type is only recorded as a category (mobile or desktop, operating system, browser name). We do not store parameters passed in the address bar (query string).
- Purpose: making the website clearer and easier to use, and understanding which marketing channels work.
- Legal basis: legitimate interest (GDPR Article 6(1)(f)). As the measurement uses no cookies and stores no personal data, prior consent is not required, which is why no cookie banner appears.
- Retention: detailed events for 120 days; aggregated statistics that cannot be linked to a person may be kept longer.
- Opting out: at any time, immediately and without giving a reason, with the Turn off analytics link at the bottom of the page.
If you fill in one of the forms, that visit is linked to the email address you gave, so that we can see which channel the enquiry came from. Without that, the analytics data stays anonymous.
3.2 Google Analytics in cookieless mode
For long-term statistics we may also use Google Analytics 4. We start it with
storage denied (Google Consent Mode v2,
analytics_storage: denied), so it does not place cookies in
your browser and does not create a persistent identifier. It only sends anonymous,
aggregated signals. No advertising measurement or profiling takes place.
- Legal basis: legitimate interest (GDPR Article 6(1)(f)), as no cookies are stored.
- Opting out: the same Turn off analytics link at the bottom of the page stops this too.
If we ever want to measure more than this, we will only do so with your explicit consent, and we will ask you again.
4. Who we share your data with
The following providers have access to your data, only to the extent needed to provide their service:
| Provider | Role | Where the data is processed |
|---|---|---|
| Cloudflare, Inc. | Hosting and serving the website, and DNS. For technical reasons it logs basic visit data (IP address, browser identifier) | EU and USA, under standard contractual clauses |
| Zoho Corporation B.V. | Handling and storing emails sent to and from systemlab.hu addresses | EU (European data centre) |
| Google Ireland Ltd. | Running the booking system, storing incoming data (Sheets, Drive), managing calendar events, sending emails | EU, and the USA under the EU-US Data Privacy Framework |
| Cloudflare, Inc. | Running the customer relationship system (CRM) and its database, where your enquiry and our correspondence are stored | EU (European data centre), under standard contractual clauses |
| Google Ireland Ltd. | Visitor statistics (Google Analytics 4) in cookieless, storage-denied mode. It creates no persistent identifier | EU, and the USA under the EU-US Data Privacy Framework |
| Google Ireland Ltd. (Gemini) | The CRM's internal assistant, used only by our staff. It only receives data when a staff member asks it a specific question, and then data belonging to that customer may be passed on. On the paid tier the provider does not use the data for model training. No email sent to you is written by AI: automatic emails are sent from pre-written templates | EU, and the USA under the EU-US Data Privacy Framework |
When data is transferred to a third country, we apply the appropriate safeguards required by the GDPR (an adequacy decision or standard contractual clauses).
5. Use of artificial intelligence
The automatic emails sent to you are not written by AI. They are sent from pre-written templates; the only personalisation is that we address you by your first name.
Our internal customer relationship system does have an AI assistant, used only by our staff: we can ask it about our own data, and it helps us phrase replies. It only receives data when one of us asks it a specific question. No automated decisions are made about you, and no profiling takes place: every meaningful decision is made by a person.
We also use AI-based solutions in client projects. In those cases we only pass on the data needed for the task, and the details of data processing are set out in a separate data processing agreement with the client.
6. Your rights
- Access: you can ask what data of yours we process.
- Rectification: you can ask us to correct inaccurate data.
- Erasure: you can ask us to delete your data if we have no other legal basis for processing it.
- Restriction and objection: you can ask us to restrict processing, and object to processing based on legitimate interest.
- Data portability: you can ask for your data in a machine-readable format.
- Withdrawing consent: at any time, with effect for the future.
You can send your request using the contact details above: by email to info@systemlab.hu, or by phone on +36 30 090 8934. We reply within 30 days at the latest.
Every automatic email we send has an unsubscribe link at the bottom: if you click it, no more automatic emails are sent to that address. Emails about a booking also contain a cancellation link, with which you can cancel the call and the related data processing.
7. Remedies
You can lodge a complaint with the Hungarian National Authority for Data Protection and
Freedom of Information:
NAIH, 1055 Budapest, Falk Miksa utca 9–11. ·
naih.hu ·
ugyfelszolgalat@naih.hu
You can also take legal action before the court of your place of residence or stay.
8. Data security
The website is only available over an encrypted (HTTPS) connection. Incoming data is stored in access-restricted accounts, on devices protected with two-step verification. The access keys belonging to the system are stored only on the server side; the website's source code contains no secret data.
9. Changes to this notice
We may change this notice at any time. The current version is always available on this page, together with its effective date.