Privacy notice — draft

HYFREY – Privacy Notice (draft for review) This draft requires completion and approval. Use fictional data only on the private test site. The document does not certify that every organisational data protection obligation has been fulfilled. 1. Controller Controller: [legal name, address and registration details]. Privacy contact: [email and postal address]. Data protection officer, if required or appointed: [details or not applicable]. A professional partner may act as a separate controller for its own service; explain its role and provide its notice before disclosing data. 2. Purposes and data Account operation and contact: name, email, authentication details and supplied phone, company and country. Identify the applicable contractual basis and any separately assessed security interest. Consultation requests: subject area, countries, language, urgency, appointment and optional description. These support steps requested before contracting, assignment and performance of the service. Payments and invoicing: billing name, address, tax details, amount, currency, provider identifiers and statuses. These support the contract and the actual invoice issuer's legal obligations. Partner applications: expertise, languages, professional background, availability, company/office, website and contact details. These support evaluation and administration of cooperation. An office introduction becomes public only after a separate publication action; contact publication is separately selectable. Security and evidence: relevant account and booking events, a rate-limit identifier derived from an IP address, accepted document versions and timestamps. Document any legitimate interest relied upon and the balancing assessment. Finalise the precise purpose-to-legal-basis mapping before public launch. 3. Required and optional information Required fields are marked. The initial description and countries may be omitted. With the confidential option, no detailed description is retained; a topic alone can be used to request discussion. Missing essential account, booking or billing data may prevent the relevant action. Marketing consent is not a condition of service. The current version does not send marketing communications. 4. Access and recipients Clients access their own cases. Authorised hub staff access the cases they manage. Approved professionals access assigned cases only; partner registration does not grant access to other clients. Visitors can read published office content. Do not publish client data in that content. Hosting uses a dedicated VPS in Frankfurt on Hostinger infrastructure. Specify the actual contracting processor: [details]. Stripe and Billingo integrations are prepared but inactive in the private test version. Before activation, list the actual providers, roles and notices. Email provider: [to be selected]. Other recipients may include authorities acting under law and necessary accounting or legal advisers. 5. International transfers Before using a non-EEA partner or provider, identify the destination, transfer basis and safeguards and explain how to obtain them. Frankfurt hosting alone does not establish that all future services keep data exclusively in the EEA. [List actual transfers, adequacy decisions or contractual safeguards.] 6. Retention Retain account and case data while needed for the service, followed only by justified claims-related or mandatory retention. Finalise separate periods for accepted/rejected partner applications, security records and backups. Keep financial documents for the period actually required of the issuer. Replace these placeholders with concrete periods or verifiable criteria and implement them operationally. Establish test-data removal before launch; test records must not automatically become production client records. 7. Rights Subject to legal conditions, individuals may request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Consent-based processing permits withdrawal of consent. Erasure may be limited by mandatory retention. Submit requests to [privacy contact]; identity checks should be proportionate. Explain the applicable response period and any justified extension. Complaints may be made to the Hungarian supervisory authority, NAIH (https://www.naih.hu), and judicial remedies are available. 8. Cookies and protection The current site uses session, CSRF-protection and language preference cookies. It does not include advertising or analytics tracking. External payment pages operate under their own notices. HTTPS, access controls, protected password storage and backup procedures protect the system, without an absolute security guarantee. New non-essential cookies require separate review. 9. Decisions and changes The current MVP uses human assignment of professionals; it does not make solely automated client assessments with legal effects. This notice is versioned. Acknowledging it is not blanket consent for every processing operation; an appropriate legal basis is required for each purpose.