Privacy Policy

This Privacy Policy explains how your personal data is collected, used, and protected, and outlines your rights under applicable data protection laws.

Márk Bartha, self-employed (hereinafter referred to as the “Controller”) is committed to handling your personal data in accordance with the provisions of:

  • Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”),
  • and Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (the “Privacy Act”).

As a data controller (as defined in Article 4(7) of the GDPR and Article 3(9) of the Privacy Act), the Controller respects your privacy and takes appropriate measures to protect your personal information.

This Privacy Policy applies to both the website (markbartha.com) and to the Controller’s freelance services. These offerings are intended for individuals aged 18 or older. By using the website or engaging with the Controller’s services, you confirm that you are at least 18 years old and legally eligible to do so.

In accordance with Article 13 of the GDPR and Section 20 of the Privacy Act, the following information is provided about our data processing activities and your rights.

Controller details

Data Protection Officer

The Controller is not required to appoint a Data Protection Officer under Article 37(4) of the GDPR.

How to contact us about data protection

If you have questions or requests related to your personal data, you can contact us by post or email using the contact details above. We will respond to your request within 30 days, free of charge, unless your request is manifestly unfounded or excessive.

Data processing and subprocessors

We only engage data processors for specific purposes outlined in Section 7. These processors act solely on our instructions and in compliance with applicable laws.

Data transfers to third countries

If your data is transferred outside the European Economic Area (EEA), it will only be transferred to countries that have received an adequacy decision from the European Commission, ensuring appropriate safeguards are in place.

Websites and applications operated by the Controller

1. Purposes of data processing

The Controller processes personal data for the following purposes, in compliance with Article 6 of the GDPR and Section 4 of the Hungarian Privacy Act:

  1. To fulfill legal obligations and maintain customer relationships related to business activities.
  2. To conduct marketing for potential customers.
  3. To process data related to employees and job applicants.
  4. To manage contact persons of business partners.
  5. To perform and deliver customer orders and services.
  6. To support internal administration.
  7. To operate and maintain the website markbartha.com, including collecting visitor statistics through Google Analytics and handling contact form submissions.
  8. To coordinate meetings and manage scheduling via online booking tools.

2. Legal basis for processing your data

Your data is processed based on the following legal grounds under the GDPR:

  1. Issuing invoices and fulfilling accounting obligations. Legal basis: Article 6(1)(c) – Compliance with a legal obligation.
  2. Partner contact management. Legal basis: Article 6(1)(f) – Legitimate interest. The Controller’s legitimate interest: business continuity.
  3. Employee data processing. Legal basis: Article 6(1)(b) and 6(1)(c) – Contract performance and legal obligation.
  4. Contracted partner data. Legal basis: Article 6(1)(b) – Contract performance.
  5. Marketing communications. Legal basis: Article 6(1)(a) – Consent.
  6. Website analytics (Google Analytics). Based on your consent (GDPR Article 6(1)(a)), collected via the website’s cookie banner.
  7. Responding to contact form messages. Based on the Controller’s legitimate interest (GDPR Article 6(1)(f)) in handling inquiries and communication.

The Controller maintains professional profiles on Facebook, X (formerly Twitter) and LinkedIn for marketing purposes. However, no separate marketing database is maintained, and no profiling is performed.

3. Data retention periods

  • Invoices and related documents: stored for 8 years after issuance.
  • Employment-related documents: stored for 50 years after conclusion.
  • Partner contact data: retained up to 1 year after the relationship ends.
  • Order/service/contract data: stored until the relationship is terminated, plus any legally required retention period.
  • Data collected via the website (e.g., analytics, contact form messages) is retained only as long as necessary for the purpose it was collected, or as required by law or third-party tool policies (e.g., Google Analytics retention limits).

All details are summarized in Section 7 for clarity.

4. Your rights as a data subject

Under Articles 15–21 of the GDPR, you have the following rights:

a) Right of access

You can request confirmation about whether your personal data is being processed and access that data.

b) Right to rectification

You can request correction of inaccurate or outdated data.

c) Right to erasure (“right to be forgotten”)

You can request deletion of your data if:

  • it is no longer needed for its original purpose,
  • you withdraw your consent,
  • you object to processing,
  • the data was unlawfully processed,
  • erasure is required by law.

If your data has been shared publicly, the Controller will take reasonable steps to inform other controllers of your erasure request.

d) Right to restriction of processing

You may request restriction if:

  • the data is inaccurate (restriction applies until corrected),
  • processing is unlawful but you oppose deletion,
  • you need the data to establish or defend legal claims,
  • you object to processing (restriction applies until resolved).

While restricted, data will only be processed:

  • with your consent,
  • for legal claims,
  • to protect others’ rights,
  • or for important public interest.

e) Right to object to processing

You may object to the processing of your personal data at any time, especially for direct marketing purposes.

f) Right to data portability

You may request to receive your personal data in a structured, commonly used, machine-readable format or request its transfer to another controller.

g) Right to lodge a complaint

You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information if you believe your data has been misused. (More details in Section 8.)

The Controller will inform you of any rectification, deletion, or restriction actions and notify any third-party recipients unless this is impossible or involves disproportionate effort. You may request a list of those recipients.

5. Notification of a personal data breach

A personal data breach, as defined in Article 4(12) of the GDPR, refers to a security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.

If such a breach occurs, the Controller will:

  • notify the Hungarian National Authority for Data Protection and Freedom of Information without undue delay, and within 72 hours if feasible, in accordance with Article 33 of the GDPR, unless the breach is unlikely to pose a risk to the rights and freedoms of natural persons,
  • maintain an internal record of all data breaches, documenting what happened, its effects, and any remedial action taken.

If a breach poses a high risk to your rights or freedoms, we will also inform you and any affected individuals directly and without undue delay, in line with Article 34 of the GDPR.

In all cases, we aim to:

  • minimize the impact of the breach,
  • prevent future incidents,
  • maintain the highest level of data protection possible.

6. Additional data processing and authority requests

We may provide additional, case-specific information before collecting data for new purposes not outlined in this policy.

We may also be required by courts or authorities (e.g., police, administrative bodies, data protection authorities) to share your personal data. We only comply with such requests if:

  • the request is legally valid, and
  • the request specifies the exact scope and purpose of the data required.

Only the minimum necessary data will be disclosed to fulfill the legal obligation.

7. Data storage and security measures

Where and how data is stored

Personal data is stored and processed:

  • on systems located at the Controller’s business premises,
  • and via trusted third-party cloud service providers, acting as data processors, including the following.

Google (Gmail, Google Drive)

  • Country: United States
  • Company: Google LLC
  • Purpose: Used to send and receive client emails, and store or share project-related documents and files.
  • Privacy policy: https://policies.google.com/privacy

Számlázz.hu

GitHub

DotNest

  • Country: Hungary
  • Company: Lombiq Technologies Ltd.
  • Purpose: Used to host the personal website (markbartha.com), including static site content and basic analytics.
  • Privacy policy: https://lombiq.com/privacy-policy

UpNote

  • Country: Vietnam
  • Company: UpNote Company Limited
  • Purpose: Used for internal note-taking, planning, and storing non-sensitive documentation related to services.
  • Privacy policy: https://getupnote.com/privacy.html

Google Analytics

  • Country: United States
  • Company: Google LLC
  • Purpose: Used to collect anonymized data about website usage for performance and traffic analysis.
  • Privacy policy: https://policies.google.com/privacy

Security principles

We design and operate our systems based on the following principles:

  • Confidentiality: only authorized individuals can access data.
  • Integrity: data remains accurate, complete, and tamper-free.
  • Availability: systems and data are accessible to authorized users when needed.

We implement appropriate technical and organizational measures, including:

  • encryption and access control,
  • activity logging and system monitoring,
  • protection against malware, unauthorized access, physical damage, and cyberattacks,
  • secure cloud infrastructure, aligned with data protection best practices.

While we take all reasonable precautions, please note that no internet communication is completely secure. This includes email, web, or FTP protocols.

8. Your remedies and supervisory authority

If you believe your rights have been violated or your data has been mishandled, you may contact or lodge a complaint with the competent supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information
Address: Szilágyi Erzsébet fasor 22/C, 1125 Budapest, Hungary
Email: [email protected]
Website: www.naih.hu

Judicial remedies

Under Act CXXX of 2016 (Hungarian Civil Procedure Code), you may initiate legal proceedings before the regional court:

  • in the jurisdiction of your residence, or
  • where the Controller is located.

Right to compensation

If you suffer material or non-material damages due to unlawful processing, you are entitled to compensation from the Controller or relevant data processor.

Processors are only liable if:

  • they violated GDPR obligations specifically addressed to them, or
  • they acted outside or against the Controller’s lawful instructions.

No liability arises if the party proves it is not responsible for the breach or damage.

9. Changes to this Privacy Policy

If we make substantial changes to this Privacy Policy (e.g., new purposes, changes in data recipients, international transfers), we will notify you in advance, using appropriate channels (e.g., email, website notice).

You will be given a reasonable amount of time to:

  • review the changes,
  • consider how they may affect you,
  • exercise any relevant rights (e.g., withdrawing consent or objecting to changes).

Minor corrections (e.g., spelling, grammar) will not trigger a separate notice.

10. Cookies and third-party services

The website markbartha.com uses cookies and third-party services to improve usability and analyze visitor behavior.

Cookies and analytics

We use Google Analytics to understand how users interact with the site. Data collected may include:

  • IP address (anonymized),
  • browser and device type,
  • pages visited, time spent, interactions.

Cookies are only stored if you consent via the banner. You can withdraw or modify your preferences anytime in your browser settings.

We do not use cookies for advertising, profiling, or behavioral targeting.

For details: Google’s Privacy Policy

Embedded content and social media

We may embed content or link to social media platforms, such as:

  • YouTube (for videos),
  • Facebook, Twitter, LinkedIn (for profile links).

When you interact with this content, your browser connects directly to the platform’s servers. These platforms may collect data such as:

  • your IP address,
  • browser/device info,
  • interaction timestamps.

YouTube videos embedded on our site will not load cookies unless you give consent. These platforms act as independent data controllers under their own privacy policies:

You can manage or delete cookies anytime via your browser. Learn more: Wikipedia – HTTP cookies