Privacy policy

Anaga Software Kft. – anagasoftware.com

Reviewed and effective: 1 November 2026

1. Controller and contact details

Company: Anaga Software Kft.
Registered office and postal address: 1147 Budapest, Ilosvai Selymes utca 120., Hungary.
Company registration number: 01-09-426613.
Registering court: Company Court of the Budapest-Capital Regional Court.
Email, including privacy requests: info@anagasoftware.com.
Website: anagasoftware.com, including its language versions.

Please send questions, requests or complaints to the email or postal address above. “We” and “Controller” below refer to this company.

2. Scope of this policy

This policy covers visitors to our website, people contacting us or requesting quotations, individual customers and contractors, business partners’ representatives and contacts, and the other processing described below. Business contact information may also be personal data.

Reading this policy is not general consent to all processing. Contacting us or using the website’s basic functions is not conditional on subscribing to marketing or accepting non-essential tracking. Processing requiring consent requires a separate, voluntary and clear choice.

Anaga Software Kft. and Kovács Gergő’s individual business are separate controllers. Common ownership or personnel does not itself authorise sharing customer records, enquiries or mailing lists. This policy covers the company named in section 1. Where another business participates as a recipient, processor or joint controller, information about that role and any transfer must be provided before the relevant processing.

When developing or operating customer systems, we may process the customer’s user data on the customer’s instructions. That processing is governed by the customer’s instructions, the applicable processing agreement and the customer’s privacy notice; this policy does not replace them.

3. General principles and sources of data

We process personal data for specified purposes, limited to the information and period necessary. Depending on the operation, the legal basis is consent, a contract or steps requested before a contract, a legal obligation, or a properly balanced legitimate interest. The specific bases appear below.

Data normally comes from you, your device when you use the website, your employer or principal, a contracting partner or a payment provider. Public company or business registers may be used to check authority to represent a business. Where data is obtained indirectly, we provide Article 14 GDPR information, including the source and data categories, within the applicable period, generally within one month and no later than the first communication or disclosure, unless a statutory exception actually applies.

Please do not send identity-document copies, card information, health information or other special-category data unless necessary for a specific matter. Unnecessary information is not used and is deleted or redacted without undue delay. Exceptionally necessary special-category processing for legal claims also requires an Article 9 GDPR condition. For legitimate-interest processing, the purpose, necessity and your rights must be balanced; you may request the relevant substance of that assessment.

4. Specific processing operations

4.1. Contact, quotations and online forms

Purpose: answering enquiries, understanding requirements, communication and preparing quotations. Data: name, necessary email or telephone number, business and representative information where needed, the message, attachments and communication records. Required form fields are marked; additional data is voluntary. Technical security information is addressed in section 4.5.

Legal basis: Article 6(1)(b) GDPR where an individual requests steps towards a contract in their own name. General enquiries and communication with an organisation’s contact rely on Article 6(1)(f): handling the enquiry and maintaining business communications. Limited retention after closing an enquiry also relies on the legitimate interest in retrieving relevant communication history and checking its handling, subject to necessity and proportionality.

Retention: if no contract follows, 12 months after closing the enquiry, and no later than 12 months after the last substantive communication. Contract-related data follows sections 4.2–4.4. Only information necessary for a specific dispute may be retained further under section 4.9. Recipients: authorised personnel and the hosting, email and project-management providers in section 5. Without necessary contact or matter information, we may be unable to respond or quote. Enquiries do not create a newsletter subscription.

4.2. Contracts, services and support

Purpose and data: preparing, entering into and performing contracts, managing projects and support, documenting delivery and settling fees. Data includes necessary identity, address, contact and representative details, orders, contracts, correspondence, delivery, support and payment information. Technical access is used only within the permissions and period needed for the task; customer user databases are covered by section 2.

Legal basis: Article 6(1)(b) for an individual contracting party; Article 6(1)(f), the legitimate interest in proper performance, for a corporate partner’s representatives and contacts. Subsequent evidential retention is addressed separately in section 4.9. Retention: the period needed to perform the contract and agreed support, followed only by necessary accounting, statutory or legal-claim retention. Unnecessary technical access is revoked; retaining evidence does not justify continued access to a customer’s system. Recipients: authorised contributors and section 5 providers according to their tasks. Necessary information is a contractual requirement; without it, services may be impossible or limited.

4.3. Business partners’ contacts

Purpose and data: identifying representatives and maintaining contractual and professional communication, appointments and tasks; name, role, business email, telephone and necessary correspondence. Sources are the person, employer or principal, and relevant public registers. Legal basis: Article 6(1)(f), both parties’ legitimate interest in reliable business communication. Retention: until the contact’s role or partner relationship ends; active contact records are updated when changes become known. Necessary historical transaction evidence may remain under section 4.9. Recipients: authorised personnel and hosting, email and project-management providers. A business contact is not automatically authorised for advertising emails.

4.4. Invoicing, payments and tax obligations

Purpose and data: issuing invoices, identifying payments, accounting, tax returns, required reporting and record retention. Data includes billing name, address and tax number where required, service and invoice details, amount, currency, payment method and time, transaction identifier and reference, payer name and account number appearing on bank records, and email for electronic invoices.

Legal basis: Article 6(1)(c) for invoicing, accounting, tax and required retention; Article 6(1)(b) for contractual payment settlement with an individual, or Article 6(1)(f) for other payers and contacts. Hungarian VAT Act sections 159 and 169 govern invoice requirements; section 179 and the relevant tax and accounting rules govern records. Retention: accounting records supporting the company’s accounts are retained for at least eight years under section 169 of Act C of 2000; other tax records follow the applicable statutory period, including extensions and special rules. This does not justify retaining every customer record or email for the same period. Mandatory invoice records cannot be erased during required retention merely because consent is withdrawn.

Recipients: the accountant, invoicing provider, relevant payment providers and Hungary’s tax authority (NAV), as described in section 5. Necessary billing data is required to issue a lawful invoice. We do not request full card numbers or security codes through the general contact form or email. PayPal may be used for separately agreed payments. Stripe is currently inactive and is listed as an available future payment option; listing it does not imply current transfers. Payment-provider details and roles appear in section 5.

4.5. Website operation, logs and IT security

Purpose: availability, troubleshooting and preventing or investigating unauthorised access, spam and misuse. Data: IP address, request time, requested resource, response code, browser and device characteristics, and necessary security events. Legal basis: Article 6(1)(f), the legitimate interest in operating and protecting our systems. Consent-requiring technologies are separately addressed in section 6. Retention: ordinary technical logs for up to 31 days; information necessary for a particular incident or legal claim may be separately retained for that investigation under section 4.9. Hosting, security and maintenance personnel receive only task-related access. Without processing the request’s necessary technical data, the website cannot be served.

4.6. Newsletters and email marketing

We currently do not operate a newsletter. Contact information is not automatically added to a mailing list. Before introducing a newsletter or electronic direct marketing, we will provide the relevant separate information and consent mechanism.

4.7. Service complaints

Purpose and data: investigating and answering complaints and meeting consumer-protection obligations; identity, contact, complaint, related transaction and response records. Legal basis: Article 6(1)(c) for mandatory consumer-complaint handling, including section 17/A of Hungary’s Consumer Protection Act; for non-consumer contractual complaints, Article 6(1)(b) or (f) as applicable. Retention: written consumer complaints and records of oral complaints, together with the response, for three years where required by that Act. Other complaints follow their contractual or legal-claim purpose. Recipients are authorised personnel and, where necessary, professional advisers, competent authorities or dispute-resolution bodies.

4.8. Privacy requests and evidence of handling them

Purpose and data: receiving, verifying, answering and documenting rights requests; necessary identity and contact information, request, verification and response records. We request proportionate identification only where needed; identity-document copies are not routinely required. Legal basis: Article 6(1)(c), compliance with GDPR Articles 12–22. A separate legitimate interest under Article 6(1)(f) may justify retaining limited evidence of compliance. Retention: while handling the request and, for necessary evidence, up to three years after closure; longer only for an identified proceeding or legal requirement. This is limited evidence, not a reason to keep the data whose erasure was requested. Recipients are authorised staff, necessary providers and advisers or authorities involved in the matter.

4.9. Establishing, exercising or defending legal claims

Purpose and data: retaining only information necessary to prove or defend a specific claim, such as relevant contracts, correspondence, delivery or payment evidence. Legal basis: Article 6(1)(f), the legitimate interest in legal protection; special-category data additionally requires an Article 9 condition where applicable. Retention: the relevant limitation period, normally five years for civil claims under section 6:22 of the Civil Code, with applicable suspension, interruption and proceedings taken into account; not an automatic five-year extension for every record. Access and use are restricted to the claim and necessary authorised personnel, legal advisers, courts or authorities.

4.10. References and customer testimonials

Purpose and data: presenting work and customer feedback, including an identifiable person’s name, image, role or attributed testimonial. Legal basis: the person’s prior, specific and voluntary consent under Article 6(1)(a), alongside applicable image and other personality rights. A company reference does not automatically authorise publishing a natural person’s details. Retention: for the authorised publication period or until consent is withdrawn, with necessary limited evidence of the permission retained separately for up to three years after publication ends, under the legitimate interest in defending legal claims. Withdrawal does not affect earlier lawful use. Public website visitors are recipients of published references. Permission is optional and is not a condition of receiving services.

5. Providers and recipients

Only authorised people receive information needed for their tasks. Processors act on our instructions; independent controllers process data under their own legal obligations and purposes, as described below.

Hosting and Hostinger email

Hostinger International Ltd.
61 Lordou Vironos str., 6023 Larnaca, Cyprus
Privacy information · Data processing terms

Processes website content, enquiries, email, technical logs and backups to host the website and mailboxes and deliver form messages. It acts as a processor for that service. Contact: gdpr@hostinger.com. Subprocessors and transfers outside the EEA are governed by the linked DPA, including Standard Contractual Clauses (SCCs).

Accounting

Acounto Magyarország Kft.
7623 Pécs, Mártírok útja 37.
Privacy information

Receives invoice, payment and necessary contact information for accounting and tax work, acting as a processor on our instructions and with independent responsibility for its own legal obligations.

Electronic invoicing

KBOSS.hu Kft. (Számlázz.hu)
1031 Budapest, Záhony utca 7/D.
Privacy information

Processes billing identity, address, tax number, email and transaction information to issue and store invoices. It acts as a processor for invoicing; its own service-related and statutory processing is described in its privacy information.

Gmail, Google Workspace, Drive and Docs

Google Ireland Limited
Gordon House, Barrow Street, Dublin 4, Ireland
Privacy information

Google Cloud EMEA Limited (Google Workspace)
70 Sir John Rogerson’s Quay, Dublin 2, Ireland
Privacy information · Data processing terms

Used for correspondence, communication and creating and storing customer documents: names, emails, messages, attachments and project or contractual documents. Both ordinary Gmail and Workspace accounts are used. Workspace processing is governed by its processing terms; ordinary Gmail and other consumer products are governed by Google’s privacy terms for their own processing. International infrastructure may involve access outside the EEA under the safeguards in those terms. Retention follows the relevant purpose and section 4.

Customer and project management: ClickUp

Mango Technologies, Inc. (ClickUp)
350 Tenth Ave, 5th floor, San Diego, CA 92101, USA
Privacy information · Data processing terms

Processes contacts, tasks, deadlines, comments and documents necessary for projects. Customer content is processed under its DPA. Contact: support@clickup.com. Processing may occur in the United States and through subprocessors; the DPA includes SCCs. Active project records follow sections 4.1–4.3 and 4.9. Occasional AI use is also covered below.

Banks and payment providers

Wise Europe SA
Rue du Trône 100, 1050 Brussels, Belgium
Privacy information

MagNet Magyar Közösségi Bank Zrt.
1062 Budapest, Andrássy út 98.
Privacy information

These are the company’s account providers. They are independent controllers for payments, identification, fraud prevention and their legal obligations. Payment records may include payer name and account number, amount, reference and transaction details.

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal, L-2449 Luxembourg
Privacy information

PayPal may process separately agreed payments as an independent controller. Depending on the transaction, data includes information entered on its payment page, payer identity and contact details, amount, currency and transaction identifier. We receive the information needed to confirm payment.

Stripe Payments Europe, Limited
The One Building, 1 Lower Grand Canal Street, Dublin 2, Ireland
Privacy information

Stripe is currently inactive. Listing this available payment option does not mean data is currently transferred to it. Before introducing a Stripe payment, transaction and provider information will be supplied on the payment interface. Card data is handled by the provider; we receive necessary transaction and payment-status information. Stripe’s role may be controller or processor depending on the operation; its retention and international transfers are described in its privacy information.

AI-assisted work tools

OpenAI Ireland Limited
1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland
Privacy information · Data processing terms

We use ChatGPT and Codex, and occasionally ClickUp AI, for development, troubleshooting, project preparation and document drafting. Depending on the task, submitted material may include project descriptions, code, correspondence or contact information. An AI tool does not itself create a legal basis for sharing personal data: necessity and the basis applicable to the task must be assessed, data must be limited, and identifiers should be removed where the task allows. Customer-controlled data also remains subject to the customer’s instructions and processing agreement.

OpenAI business services are subject to the DPA’s processor provisions; consumer services follow the applicable terms and account controls. Further use of content depends on the terms and privacy controls applicable to the account type. Contact: privacy@openai.com. Processing outside the EEA, particularly in the United States, may occur under the provider’s published safeguards. Conversation and working-file retention depends on the task, account settings and the provider’s deletion, security and legal rules. People evaluate AI suggestions.

Other authorised contributors and authorities

Contributors receive only data needed for their tasks. Information is disclosed to NAV, other authorities or courts where legally required. Before introducing a new provider or materially different processing, this notice is updated.

6. Cookies, analytics and embedded content

6.1. Managing consent

Cookies and local storage identifiers are data stored in your browser. Necessary technologies support the website, remember your choices and provide security. You can choose whether to allow non-essential analytics, advertising and external media processing in the consent manager. Cookie choices are separate from contacting us or entering into a contract.

Consent manager: the Must Have Cookie plugin running on this WordPress website. Use the footer’s “Cookie settings” link to reopen your preferences. Cookie policy · Open cookie settings

6.2. Google Analytics 4

We use Google Analytics 4 to analyse visits, pages used, events and device characteristics. Device and browser information, approximate location, identifiers and event data may be sent to Google. Tag management supports the technical loading of measurement tags.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The applicable processing terms govern analytics customer content; Google’s privacy terms govern its own processing purposes. Google privacy information · Data processing terms · Analytics opt-out tool.

The legal basis for consent-based measurement is Article 6(1)(a) GDPR. You may withdraw consent without affecting the lawfulness of earlier processing. Cookie lifetime and Google’s server-side retention are different: the latter depends on the product’s account settings and service rules. You can also request information about the applicable retention and deletion options using our contact details in section 1. Processing outside the EEA, including in the United States, may occur under Google’s published safeguards and section 7 below.

6.3. External content and abuse prevention

The contact section contains a Google Maps embed and Google reCAPTCHA. They may process IP addresses, browser, device and interaction information and related identifiers. Maps is external media content. reCAPTCHA protects the form against automated misuse. Our legitimate interest in necessary security processing is protecting the website and communications; separate operations requiring consent are subject to your cookie choices.

The provider is Google Ireland Limited; see Google’s privacy information and cookie information. This website does not offer a newsletter subscription.

6.4. Identifiers and retention

These are identifiers associated with the integrated services; not every identifier appears during every visit. Login status, consent, third-party accounts and browser restrictions affect their use and expiry. A provider’s default cookie lifetime does not establish the actual server-side retention selected in an account. See Google’s GA4 cookie documentation and the consent manager for further information.

7. Transfers outside the European Economic Area

International cloud, email, project, AI and Google services may involve processing or access outside the EEA. A transfer requires an applicable Chapter V GDPR mechanism, such as a valid adequacy decision or Article 46 safeguards, including SCCs and supplementary measures where necessary. A provider’s appearance on this list does not mean all data is sent to every provider or country.

The linked privacy and processing terms describe the relevant providers’ transfer arrangements and subprocessors. You may request information about the safeguards, and a copy or the relevant substance, at our section 1 address, with protection for others’ rights and confidential information. An exceptional Article 49 derogation is not used as a routine substitute for appropriate safeguards.

8. Security, deletion and incidents

Measures proportionate to risk include task-limited access, access protection, maintenance, secure transfer and necessary recoverability. Contributors are bound by confidentiality and privacy obligations. No system is entirely risk-free; this does not restrict our statutory responsibilities.

Data is deleted or effectively anonymised when its purpose and retention period end. Backups are for recovery and must not unnecessarily prolong active processing. Deleted records disappear through the applicable backup overwrite cycle; if a backup is restored, earlier deletion instructions must be reapplied. Provider backup and security rules also apply; further information about a specific deletion is available from our section 1 contact.

Incidents are investigated and documented. Where required, the supervisory authority is notified without undue delay and, where feasible, within 72 hours after awareness; delay must be explained. People affected by a high-risk incident are informed without undue delay, subject to the exceptions in Article 34 GDPR.

9. Your rights and handling requests

Subject to the relevant conditions, you may request information and access, correction, erasure, restriction and data portability. Portability applies to automated processing based on consent or a contract and does not automatically cover every record. You may withdraw consent at any time without affecting earlier lawful processing. Mandatory record retention or legal claims may prevent immediate erasure of particular information.

You may object, for reasons relating to your situation, to Article 6(1)(f) processing; we then assess whether compelling grounds or legal claims justify continuing. Objection to direct marketing must be respected without such balancing.

Please use the email or postal address in section 1. We respond without undue delay and normally within one month. Where permitted because of complexity or number of requests, this may be extended by up to two further months, with reasons provided within the first month. Requests are generally free; manifestly unfounded or excessive requests may justify the GDPR’s proportionate fee or refusal conditions. Any refusal is explained with information about remedies. Identity checks are limited to what is necessary. Where required, corrections, erasure or restrictions are communicated to recipients, and you may request information about them.

10. Complaints and judicial remedies

You may contact us directly, complain to a competent supervisory authority, or seek a judicial remedy. The Hungarian authority is the National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; email: ugyfelszolgalat@naih.hu; website: naih.hu. You may also complain to the authority in your habitual residence, place of work or place of the alleged infringement. Under GDPR Article 79, proceedings may also be brought before the courts of your habitual residence where applicable.

11. Children and automated decisions

Where Article 8 GDPR applies to a consent-based information-society service offered directly to a child, a child under 16 in Hungary requires the holder of parental responsibility’s consent or authorisation, with reasonable verification efforts. This is not a general contractual age rule; civil-law capacity and representation rules apply separately.

Within the processing described here, we do not make solely automated decisions producing legal or similarly significant effects. AI tools support work; a person makes substantive customer and service decisions. Before introducing significant automated decision-making, its basis, meaningful logic, consequences and safeguards must be separately explained.

12. Updates and legal framework

We update this notice when the relevant services, purposes, recipients or rules change and provide appropriate notice of material changes. A new purpose requires an applicable legal basis and prior information; publishing an updated policy is not consent. The main framework includes the GDPR, Hungary’s Act CXII of 2011, the Civil Code, applicable electronic-commerce, electronic-communications, consumer-protection, accounting and tax rules. The version and effective date appear above.

13. Social media

Our company page is Anaga Software on LinkedIn. Names, profile details, messages, comments and interactions may be processed for communication, answering enquiries and maintaining a public professional presence. Enquiries follow section 4.1; users may also remove public comments using the platform’s controls.

The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Its processing is described in LinkedIn’s privacy policy; joint processing for page statistics is addressed in the Pages Joint Controller Addendum. You can contact us through our own website without visiting the social platform.

Back to top · Home