Privacy Policy
This policy explains what personal data is processed when you visit kristofkarner.com or contact me. The principle is simple: I process only what the work cannot be done without — and whatever can be left uncollected, I do not collect at all.
It is based on Regulation (EU) 2016/679 (GDPR) and Hungarian Act CXII of 2011 on informational self-determination and freedom of information (Infotv.).
1. The controller
- Name
- Kristóf Karner, sole trader (egyéni vállalkozó)
- Registered seat
- Alsó Völgy utca 14/A, 1021 Budapest, Hungary
- Registration number
- 59509570
- Tax number
- 90328037-1-41
- Main activity
- Custom software development (NACE 620101)
- Website
- kristofkarner.com
I am not required to appoint a data protection officer: I am not a public authority, my activity does not involve regular and systematic monitoring of data subjects on a large scale, and I do not process special categories of data on a large scale (Article 37 GDPR).
Further identifying details of the provider — including those of the hosting company — are in the imprint. This notice covers the processing of personal data; storage in your browser is covered separately in the cookie notice.
2. What I do not collect
This section comes first because most privacy risk disappears here. The website consists of static HTML pages with no database behind them and no tracking code. The booking tool runs on a separate subdomain with a small database of its own; section 3.6 describes it. Specifically:
- No cookies and no equivalent technology (local storage, session storage, fingerprinting), in the booking tool either. That is why there is no consent banner — there is nothing to consent to.
- No analytics (Google Analytics or similar) and no advertising trackers (pixels, remarketing tags).
- No embedded third-party content — no embedded maps, videos, social media widgets or external font services. Every asset loads from this site's own server, so your browser never contacts a third party.
- The only form is in the booking tool (section 3.6); there is no registration and no user account.
- No profiling and no automated decision-making (Article 22 GDPR).
- I neither buy nor sell contact databases. When I write to a business unprompted, section 3.5 describes how.
3. Data processed, purposes and legal bases
3.1 Visiting the website — server logs
Like every web server, the one serving this site keeps technical logs. I do not create these entries and do not combine them with other data; the hosting provider's system records them automatically.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| IP address, timestamp, requested path, HTTP status, user agent, referring page | Operating the service, resolving faults, detecting attacks and abuse | Legitimate interest — Article 6(1)(f): operating the site securely and keeping it available | Per the hosting provider's log rotation, at most 30 days, then deleted automatically |
Balancing test: without logging, operating and defending the site would not be feasible, while the impact on the data subject is minimal — the records are not combined with other data, are not used for monitoring or differentiation, and are deleted after a short period.
3.2 Contact by e-mail
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, e-mail address, the content of your message and any attachments, plus anything else you choose to include | Answering your enquiry, preparing a quote, preparing possible cooperation | Steps prior to entering into a contract, at your request — Article 6(1)(b) | If no contract follows: 2 years from the end of the exchange. If one does: see 3.3 |
Please do not send data by e-mail that the matter does not require — in particular no passwords, banking details or health information. If access to a system is needed, we arrange that separately and securely.
3.3 Client relationship and performance of a contract
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, billing name and address, tax number, contact details, technical data covered by the engagement | Delivering the service, staying in contact | Performance of a contract — Article 6(1)(b) | 5 years from termination of the contract (general limitation period under the Hungarian Civil Code) |
| Billing data on issued accounting documents | Retention of accounting records | Legal obligation — Article 6(1)(c), under Section 169 of Hungarian Act C of 2000 on Accounting | 8 years. This period cannot be shortened and is not affected by an erasure request |
3.4 Being featured as a reference
I may present completed work on this website as a reference. This normally concerns companies, so it is not personal data. Where a reference would contain a natural person's name, photograph or identifiable testimonial, I publish it only with prior consent (Article 6(1)(a)). Consent may be withdrawn at any time, without giving reasons, at kristof@kristofkarner.com; on withdrawal I remove the content without delay. Withdrawal does not affect the lawfulness of processing before it.
The Google reviews shown on the site are publicly available content published voluntarily by the reviewers, displayed here with abbreviated names.
3.5 Business outreach
Occasionally I write to a business when its public website shows a problem I can measure from outside — in its email authentication or its accessibility, for example. I then send a single email, with no follow-up.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| The business's name, the business e-mail address published on its website or in the company register, and the website's externally measurable characteristics | A single e-mail about the measured problem, and a record of whom I have already written to | Legitimate interest — Article 6(1)(f) | The measurement and the contact details for at most 12 months if no reply arrives. The fact that I have written to a business, or that it asked for no further e-mails, indefinitely — without it I could not keep to writing only once. |
If you do not want further e-mails, a single reply is enough: your website's address goes on a blocklist, and I will not write again. This is your right to object (Article 21), and it needs no reason.
3.6 Booking a video call
On idopont.kristofkarner.com you can book a video call of up to 30 minutes. The booking pages are in Hungarian only; in English, e-mail is the way to reach me. You confirm a booking with the link you receive by e-mail; until then I hold the time for two hours. With the link in the e-mail you can cancel a confirmed call, or move it to a later time, twice at most.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Your e-mail address and the time you chose; if you give them, your name, your website's address, the topic of the call and your note | Arranging the call: the confirmation, sending the Google Meet link and a calendar entry, a reminder before the call, cancelling and moving it | Steps prior to entering into a contract, at your request — Article 6(1)(b) | 30 days after the call. An unconfirmed booking is deleted one day after its two hours run out, a cancelled one 30 days after it was made. |
| Keyed hashes of your IP address and your e-mail address — the IP address itself is not stored — and, when an address is blocked, a shortened form of it | Filtering out abuse: one call at a time per address and per network, an address that cancelled again and again or did not turn up for a call cannot book for a while, I can block someone who misuses the tool, only a few bookings can be started in a short time, and at most three e-mails a day go to one address | Legitimate interest — Article 6(1)(f) | The counters are deleted after 2 days, the hash tied to a booking together with the booking. For a block, the hash of the address and its shortened form are kept for 1 year, the hash of the network for 7 days. |
When you book, I also check that the domain of your e-mail address receives mail and is not a throwaway one. For this I look up the domain name in the public DNS; the address itself goes to no one. Booking needs JavaScript to run in your browser: that is how the page tells a real touch from a program sending the form. Nothing is stored in your browser for this.
The booking tool also keeps anonymous statistics of how it is used: when it was opened, from a phone or a computer, which of my pages or ads the visit came from, how far the booking got (whether another day was looked at, a time was chosen, the form was started, but not what you typed), which day and time a booking was for, and what became of it. There is no IP address, e-mail address, name or anything else in it that identifies a person, so this is not personal data.
I receive a notification of each confirmed booking. If a booking is not confirmed, I still receive its details once the two hours run out, because the confirmation can end up in spam or go to a mistyped address. I may then write one e-mail to ask whether the call is still wanted; if no reply comes, I do not write again. The notifications stay in my mailbox under the retention of section 3.2.
The call itself takes place on Google Meet. When you follow the link, Google processes the data needed to join — your IP address, for example, and your Google account's name if you join signed in — as an independent controller, under its own privacy policy. I do not record calls. The booking tool uses no cookies either: the confirmation, the cancellation and the move travel in the links you receive by e-mail.
3.7 English pages: are you in Hungary?
When you arrive at an English page from outside the site, your browser asks my own subdomain (idopont.kristofkarner.com) whether the request comes from a Hungarian IP address. If it does, the page offers, in Hungarian, its Hungarian version and the booking. The answer is a yes or a no; I do not store the IP address and send it to no third party. The country comes from RIPE NCC's public address registry, which shows where an address was registered — so it can be wrong. Moving between pages within the site sends no such request.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Your IP address, at the moment of the request | Offering the Hungarian version to someone viewing the English page from Hungary | Legitimate interest — Article 6(1)(f): that a Hungarian visitor can reach the site and the booking in their own language | Not stored. The request leaves a server log entry under section 3.1. |
4. Processors
A processor handles data on the controller's behalf, on their instructions. At present there is one:
- Name
- Tárhely.Eu Szolgáltató Kft.
- Role
- Hosting and e-mail services, running the booking tool
- Data involved
- Server logs, content and headers of e-mail messages, booking data
- Location of processing
- Hungary (European Union)
Where accounting services are used, the accountant also processes the accounting records, in order to fulfil a legal obligation.
Google is not my processor: during a video call it acts as an independent controller (section 3.6).
5. Access to clients' systems
This section concerns clients who engage me for work — not visitors to this website.
While building and maintaining websites and business systems, I may gain access to systems in which my client processes the personal data of third parties (for example, their customers). In those cases I act not as a controller but as a processor: I touch the data only on the client's documented instructions and only to the extent the engagement requires.
- I keep no copies of my own, other than a temporary development copy where the work requires one, which I delete once the task is complete.
- I never use such data for my own purposes and never pass it to third parties.
- Access credentials are returned or revoked at the end of the engagement, or earlier on the client's request.
- A data processing agreement under Article 28 GDPR can be concluded at any time at the client's request; for ongoing maintenance engagements I propose one myself.
- If I detect a personal data breach in a client's system, I notify the client without delay, so that they can meet their 72-hour notification duty (Article 33 GDPR).
6. Transfers outside the EU
None take place in serving the website. Serving the website and the booking tool, and receiving and storing e-mail, all happen within the European Union. The site loads no externally hosted asset — no font, script or image — so your browser initiates no connection to a provider outside the EU.
There are two exceptions. One: if you write to me from a mail provider operating outside the EU, the journey of that message begins at your own provider, which is outside my control.
The other is the video call. In the European Economic Area, Google Meet is provided by Google Ireland Limited, but Google may also transfer data to the United States; that falls under the EU–U.S. Data Privacy Framework, which Google LLC has joined. If you would rather avoid it, write an e-mail: the call is never a condition of anything.
7. Security measures
- Encrypted connection: the site is served over HTTPS only, with a valid certificate.
- Authenticated e-mail: the domain has SPF, DKIM and DMARC configured. This makes it considerably harder for anyone to send fraudulent messages in my name from my address — for instance a fake invoice with an altered bank account number.
- Reduced attack surface: the site consists of static files; there is no database, content management system or login screen to attack. The booking tool runs separately, on its own subdomain. It has no password: it can be managed only through a single-use link sent to my own address. Its data is deleted 30 days after the call.
- Access control: provider accounts are protected by unique, strong passwords and, where available, two-factor authentication.
- In the event of a personal data breach I notify the supervisory authority within 72 hours of becoming aware of it, and inform affected individuals where the breach is likely to result in a high risk (Articles 33–34 GDPR).
8. Your rights
You may exercise any of the following, free of charge:
- Information and access — find out whether I process data about you and obtain a copy (Article 15).
- Rectification — have inaccurate data corrected (Article 16).
- Erasure — have your data deleted where the purpose has ceased (Article 17). This does not extend to accounting records, whose retention is required by law.
- Restriction — ask that data be kept but not used while a dispute is resolved (Article 18).
- Objection — object to processing based on legitimate interest (Article 21). This applies to the server logs, to the abuse limits of the booking tool and to the country check on the English pages.
- Portability — receive data processed on the basis of consent or contract in a machine-readable format (Article 20).
- Withdrawal of consent — where processing is based on consent, withdraw it at any time. Withdrawal does not affect the lawfulness of processing before it.
Send your request to kristof@kristofkarner.com. I respond within 30 days at the latest. Where a request is complex this may be extended by two months — I will tell you within the first 30 days if that happens.
If I have reasonable doubts about your identity, I may ask for further information to verify it. The purpose is to stop anyone else from obtaining your data in your name.
9. Remedies
If you believe something has gone wrong with your data, please contact me first — most questions are settled in a single exchange. Regardless, the following remedies are always open to you:
- Supervisory authority
- Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
- Address
- Falk Miksa utca 9–11, 1055 Budapest, Hungary
- Postal address
- 1363 Budapest, Pf. 9, Hungary
- Phone
- +36 1 391 1400
- ugyfelszolgalat@naih.hu
- Website
- naih.hu
You may also seek a judicial remedy. Proceedings may be brought before the court of your place of residence or stay, at your choice (Article 79 GDPR, Section 23 Infotv.).
10. Changes to this policy
I update this policy when the circumstances of processing change — for example if analytics were introduced in future, or if a new processor were engaged. Changes take effect on publication, and the effective date and version number always appear at the top of the document.
For material changes — such as a change in the legal basis or purpose of a processing activity — I keep earlier versions available, so it stays traceable what applied and when.
Changes. 1.3 (4 November 2026): section 3.6 now covers moving a call, filtering out abuse, blocking, and the anonymous count of the booking steps. In version 1.2 the hash was kept for 2 days throughout, and covered the IP address only.
1.2 (29 October 2026): new section 3.6 on booking a video call and new section 3.7 on the country check of the English pages; sections 2, 4, 6, 7 and 8 follow them. In version 1.1, section 2 read: “No contact form, no registration and no user accounts.” Section 6 began: “None take place.”
1.1 (13 October 2026): new section 3.5 on business outreach. In version 1.0 (20 July 2026), section 2 read: “I neither buy nor sell contact databases, and I do not send cold outreach.”