Privacy notice

1. Preamble

The purpose of this Privacy Notice (hereinafter: the Notice) is to inform data subjects, in advance, clearly and transparently, as required by Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: the Website) and by Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (hereinafter: the GDPR), about the processing of personal data connected with the use of the TransIAlt LIVE website available under the translaitlive.hu domain (hereinafter: the Info Act), with its quote request and contact processes, and its AI chat assistant.

This Notice covers the processing carried out via the Website. It does not cover data processed individually for a given event, under a separate contract or agreement, in the course of the live translation and subtitling service provided under the TransIAlt LIVE brand with on-site operator involvement – data subjects are informed about the latter separately, within the framework of that legal relationship.

2. Definitions

The terms used in this Notice have the meaning defined in Article 4 GDPR. The most important of these are:

Personal data

Any information relating to an identified or identifiable natural person (the “data subject”).

Data subject

The natural person whose personal data the Controller processes – in this case typically a visitor to the Website, a person completing the quote request or contact form, or a person using the chat assistant.

Processing

Any operation performed on personal data, in particular collection, recording, storage, use, transmission and erasure.

Controller

The natural or legal person who determines the purposes and means of the processing of personal data – for the purposes of this Notice, the person identified in section 3.

Processor

A person who processes personal data on behalf of the Controller, on its instructions.

Consent of the data subject

Any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

Personal data breach

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data processed.

Third country

A country outside the European Economic Area (EEA).

3. The controller and its contact details

Name: Péter Gazsó, sole trader
Registered office / postal address: 1103 Budapest, Petrőczy utca 23. fsz. 4.
Tax number: 66764829-1-42
Registration number: 38765298
E-mail: hello@translaitlive.hu

The Controller does not appoint a separate data protection officer, as there is no obligation to do so under Article 37 GDPR; data protection enquiries may be submitted to the e-mail address above.

4. Scope and legal background of this notice

This Notice is based in particular on the provisions of the following legislation:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR);
• Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (Hungarian “Infotv.”);
• Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (Hungarian “Eker. tv.”);
• Act V of 2013 on the Civil Code (Hungarian “Ptk.”), with regard to processing prior to entering into a contract.

This Notice applies to every visitor and user of the Website, regardless of their nationality or place of residence, where they provide personal data to the Controller through the Website.

5. Principles we follow

In processing personal data, the Controller applies the principles set out in Article 5 GDPR:

• Lawfulness, fairness and transparency – processing is lawful, fair and transparent to the data subject.
• Purpose limitation – we collect data solely for specified, explicit and legitimate purposes and do not further process it in a manner incompatible with those purposes.
• Data minimisation – we request only the data strictly necessary to achieve the purpose (see section 8).
• Accuracy – we strive to keep the data processed accurate and up to date.
• Storage limitation – we store data only for as long as necessary, in accordance with defined retention periods (see section 8).
• Integrity and confidentiality – we protect data with appropriate technical and organisational measures (see section 10).
• Accountability – the Controller is responsible for, and able to demonstrate, compliance with the above principles.

6. Individual processing activities

6.1 Completing the quote request form

The quote request form on the Website allows visitors to request an individual quote by providing details of their event. The characteristics of this processing are summarised in the table below.

6.2 Use of the AI chat assistant

Before forwarding, the Controller examines the message entered into the chat by automated means to determine whether it falls within the scope of the Service. Messages outside that scope or of an abusive nature are NOT forwarded to OpenAI Ireland Limited; instead, the server returns a predefined informational response. This check reduces the volume of data transferred; its legal basis is the Controller's legitimate interest (Article 6(1)(f) GDPR).

6.3 Sending the conversation by e-mail (optional feature)

6.4 Contact form

6.5 Technical operation of the Website (server logging)

In line with generally accepted web server practice, the server hosting the Website may create technical log entries (e.g. IP address, timestamp, requested resource) in order to serve requests; these are recorded temporarily on the hosting provider's infrastructure for troubleshooting and security purposes. The purpose of this logging is to ensure the secure and proper operation of the Website; its legal basis is the legitimate interest of the Controller and the hosting provider (Article 6(1)(f) GDPR) in operating the service and protecting it against misuse. The retention period for log data is determined by the hosting provider's operating practice in force from time to time.

In addition, the Website protects the quote request, contact, chat, and conversation e-mailing endpoints with rate limiting; for this purpose it counts incoming requests by IP address for a short period, to the extent technically necessary, in order to prevent abusive use. The legal basis is the legitimate interest of the Controller (Article 6(1)(f) GDPR).

Data submitted through the quote request and contact forms is subject to an automated abuse-prevention check at the moment of submission. As part of this, the Controller examines the form's hidden technical field, the signed technical marker issued by the server for the submission, and – by automated means only – the text of the message, in order to determine whether it shows signs of automated bulk sending (spam). To filter out identical submissions following each other within a short period, the system keeps a non-reversible checksum derived from the submission's e-mail address and message text in the server's memory for a maximum of 10 minutes, after which it is deleted automatically. The content of a submission stopped by the check is neither stored nor forwarded by the Controller; the server log records only the technical reason for the rejection and the IP address of the request. The purpose of this processing is to protect the Website's services against abusive and automated use; its legal basis is the Controller's legitimate interest (Article 6(1)(f) GDPR).

The Website does not load external resources that would transmit visitor data to third parties without consent (e.g. third-party font services). The Website uses visitor-tracking, statistical cookies solely as described in section 6.6, subject to the visitor's prior consent.

6.6 Analytics cookies (Google Analytics)

6.7 Quote preparation and quote records

The Controller operates its own, non-public, password-protected application for preparing and keeping records of individual quotations. Only the Controller has access to the application.

6.8 Marketing: ad measurement (Google Ads conversion measurement)

7. Use of processors

For the processing activities detailed in section 6, the Controller uses the following processors, subject to the conditions set out in Article 28 GDPR:

Processors may process personal data solely on the written instructions of the Controller, to the extent necessary to perform the assignment, and may not use it for their own purposes. The Controller accepts data processing contractual terms under Article 28 GDPR with the processors (in the case of these providers, the Data Processing Addendum forming part of their general terms and conditions).

8. International data transfers

Some of the processors identified in section 7 may also process data in the United States, which is outside the European Economic Area and qualifies as a third country. The lawfulness of these transfers is ensured by the following safeguards under Chapter V (Articles 44–49) GDPR:

• Google LLC (web analytics and ad measurement): Google LLC is a certified participant in the EU–U.S. Data Privacy Framework, recognised as adequate by Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, so the transfer is based on an adequacy decision under Article 45 GDPR.
• OpenAI (AI chat assistant): the Controller's contracting party within the European Economic Area is OpenAI Ireland Limited. Transfers to the United States are based on the Standard Contractual Clauses approved by the European Commission (Article 46(2)(c) GDPR), set out in the Data Processing Addendum concluded between the Controller and OpenAI Ireland Limited. OpenAI is not a certified participant in the EU–U.S. Data Privacy Framework.

The current validity of Google’s certification can be checked in the official DPF register (dataprivacyframework.gov). The processor RackForest Informatikai Kereskedelmi Szolgáltató és Tanácsadó Zrt. has its registered office in Hungary, so its use does not involve a transfer to a third country.

9. Data security measures

The Controller applies technical and organisational measures appropriate to the level of risk under Article 32 GDPR, in particular:

• the quote request, contact and chat endpoints are protected by rate limiting against abusive, bulk access attempts;
• the scope of data processed is limited to the minimum necessary to achieve the purpose (data minimisation, Article 25 GDPR);
• the retention period for quote request data is enforced by a technically automated, time-limited deletion mechanism (see section 6.1);
• personal data is accessible only to the Controller and the contracted processors; it is not disclosed or sold to third parties;
• the quote request and contact forms are protected against bulk automated submissions by an automated abuse-prevention check (hidden technical field, server-signed technical marker, content inspection);
• the Website sends security headers to browsers (content security policy, anti-framing and content-type enforcement headers) that reduce the risk of malicious content injection;
• the server serves only the file types required to display the Website; the application's source code, configuration files and files containing submissions are not accessible over the web;
• the quote preparation application referred to in section 6.7 runs on a non-public subdomain, is accessible exclusively over an encrypted (HTTPS) connection, and is protected by two independent access control layers: server-level password protection and the application's own login; the database is located in a directory not directly accessible from the web, and the application is excluded from search engines;
• credentials (API keys) do not appear in the Website's source code; the Controller manages them separately and securely.

10. Automated decision-making and profiling

In operating the Website, the Controller does not carry out decision-making based solely on automated processing – including profiling – within the meaning of Article 22 GDPR that would produce legal effects concerning the data subject or similarly significantly affect them. The AI chat assistant provides information-only responses, which do not constitute a decision producing legal effects concerning the data subject. The abuse-prevention check applied to the forms (spam filtering) likewise does not constitute such decision-making: it examines only the technical characteristics of the submission, does not evaluate the Data Subject as a person, and does not prevent the Data Subject from contacting the Controller directly at the e-mail address given in section 3.

11. Handling of personal data breaches

If the Controller becomes aware of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, the Controller shall notify the Hungarian National Authority for Data Protection and Freedom of Information without undue delay and, where feasible, not later than 72 hours after having become aware of it, in accordance with Article 33 GDPR. If the breach is likely to result in a high risk to the rights and freedoms of data subjects, the Controller shall also inform the natural persons concerned without undue delay, in accordance with Article 34 GDPR.

12. Rights of the data subject

Under Chapter III GDPR, the data subject has the following rights:

• Right of access (Article 15): the data subject has the right to obtain confirmation as to whether their personal data is being processed and, if so, to access that data and information about the circumstances of the processing.
• Right to rectification (Article 16): the data subject may request the rectification of inaccurate personal data and the completion of incomplete data.
• Right to erasure / “right to be forgotten” (Article 17): in specified cases (e.g. withdrawal of consent, or where the data is no longer necessary for the purpose) the data subject may request the erasure of their data.
• Right to restriction of processing (Article 18): in specified cases the data subject may request that the Controller merely store their data and carry out no further processing.
• Right to data portability (Article 20): the data subject has the right to receive the data concerning them which they have provided in a structured, commonly used, machine-readable format, and may request its transmission to another controller, where the processing is based on consent or a contract and is carried out by automated means.
• Right to object (Article 21): where processing is based on legitimate interest, the data subject may object at any time on grounds relating to their particular situation.
• Right to withdraw consent (Article 7(3)): where processing is based on consent, the data subject may withdraw consent at any time without giving reasons; this does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

13. How and within what time limit these rights may be exercised

The data subject may exercise the above rights by sending a request to hello@translaitlive.hu . The Controller shall comply with the request without undue delay and in any event within one month of receipt, and shall inform the data subject accordingly. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests, subject to prior notification of the data subject.

Before complying with the request, the Controller is entitled to verify the identity of the data subject to a reasonable extent, in order to prevent misuse.

14. Remedies

If the data subject considers that the processing of their personal data infringes the GDPR or the Info Act, they may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Article 77 GDPR). Data subjects resident in another EU Member State may also lodge a complaint with the supervisory authority of their own Member State:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: Falk Miksa utca 9–11, 1055 Budapest, Hungary
Postal address: 1363 Budapest, P.O. Box 9, Hungary
Phone: +36 (1) 391-1400
E-mail: ugyfelszolgalat@naih.hu
Weboldal: naih.hu

Under Articles 78–79 GDPR, the data subject also has the right to an effective judicial remedy. At the data subject's choice, proceedings may also be brought before the court with jurisdiction over their place of residence or stay. Proceedings against the Controller or a processor may be suspended pending judgment where proceedings concerning the same subject matter are pending before the NAIH.

15. Amendments and entry into force

The Controller reserves the right to amend this Notice unilaterally, in particular where the functions of the Website are extended or the legal environment changes. The Controller publishes amendments on this page, indicating the version number and the date of entry into force. The version in force from time to time applies; earlier versions can be reviewed in the change history listed in section 16.

16. Version history