Privacy Policy

Spirity on privacy

We hereby commit to defend your personal data from any illegal use, data leaks, and data breaches.

We believe that we, as a provider of services, need to be as open and straightforward as possible regarding our usage of the personal data of our visitors and clients. We will do everything in our power to only forward your personal data to third parties who provide the adequate measures for safety and security that your personal data requires.

This policy explains how we collect and handle your personal data across our website, in as plain and simple a manner as possible.

We can only speak for ourselves, so this policy does not cover the collection or use of your information by any other service provider which we may feature on our website. That means when you go to a different service provider’s website using our website, your information will be processed by them in accordance with their own privacy policy and terms of service.

If you have any form of question or suggestion, please feel free to contact us at hello@spirity.hu

Data controller

Controller

Spirity Enterprise Zrt. (Plc.) — hereinafter “Spirity”

Headquarters

1117 Budapest, Október huszonharmadika utca 8-10., Hungary

Tax number

26633710-2-43

E-mail contact

hello@spirity.hu

Website

https://www.spirityenterprise.com

About Spirity’s data processing in general

• We use your data to provide you our services and to maintain, improve, and protect our infrastructure and services.
• We may also use your personal data based on your consent to send you our newsletter and offers, to contact you regarding our business and marketing messages, or to track your use of the website.
• The personal data will either be provided by you to us directly, or will be sent along with your internet usage.
• All personal data we have on you will be deleted or anonymized at most 90 days after it has been collected or ceased being relevant.
• We only use third parties and host data in countries which provide adequate security comparable to the GDPR’s requirements.

On reasons for using personal data

We use your personal data to provide you our services — to authenticate you as a client, provide you bills, and maintain and improve our infrastructure.

We use your personal data

• to send you bills,
• for sending you our newsletter or offers,
• to enhance the quality of our service and thus elevate your user experience,
• to protect your data and our infrastructure,
• to communicate with you.

Our legal bases

• To perform a contract with our clients, including billing.
• Because it is in our legitimate interest to understand our clients and to improve and secure our service — via anonymous usage and user parameter statistics, maintenance and security logs, and the use of anonymous statistics.
• Based on your consent, to receive newsletters and additional offers, or to track website usage.
• Based on our legitimate interest, to send marketing emails to company email addresses.
• Out of legal obligations that require personal data.

On collecting personal data

We only collect the personal data we actually use, and no more. It reaches us either because you typed it into a form on this site, or because your browser sent it as part of the request.

You give us directly

• your name, work email address and, if you provide them, your company, job title and phone number,
• whatever you choose to write in a message, a meeting note or an assessment,
• for partner portal accounts: the same details plus a password, which we store only as a cryptographic hash and can never read.

Your browser sends automatically

• your IP address, which we use to apply rate limits and to record where a submission came from,
• the browser and device your request identifies itself as,
• the page on our site the submission came from.

We do not buy personal data, we do not receive it from social media platforms, and there is no social login on this site. We cannot see which sites you visit before or after ours.

Our services are not intended for children under 16 years of age, and no one under the age of 16 should provide any information to, on, or via our services. We do not knowingly collect personal data from children under 16 and will delete any that we learn we have collected or received that was not provided by, or with express consent on behalf of, the child’s parent or legal guardian.

What each part of this site does with your data

Every form on this site is described below: what it collects, why we are allowed to hold it, and what happens to it afterwards. Each one requires you to accept this policy before it will submit.

Contact form

Your name, work email and message, plus any company, job title, phone number and subject you add. We use it to answer you. Lawful basis: your consent, and our legitimate interest in responding to people who ask us something. It is emailed to our team and recorded in our CRM.

Partner application

The same, plus the country, website, partner type, region and company size you provide. Used to assess and follow up a partnership enquiry, on the same basis, and recorded in our CRM as a potential partnership.

Meeting booking

Your name, work email, optional phone and company, any note you add, and the time zone your browser reports. We use it to create the meeting and send you a calendar invitation with a joining link. Lawful basis: taking steps at your request before entering into a contract. The appointment is created in our Microsoft 365 calendar; cancelling is possible from the link in your confirmation email.

Security assessment

Your name, work email, company name and optional phone, website and country, together with the answers you give. Your answers describe how your organization currently handles security, which is sensitive commercial information — we treat it accordingly. We use it to produce your report and to prepare a conversation about it. Lawful basis: your consent, and our legitimate interest in following up a qualified enquiry.

Partner portal account

Your name, work email, optional company and phone, and a hashed password. Used to authenticate you. Lawful basis: performance of the partner agreement. Sign-in sessions last 24 hours; you can end them at any time by signing out.

Deal registration

When a partner registers an opportunity they submit the name, email and, optionally, phone number of a contact at their prospective customer. That person has usually had no contact with us. We hold those details solely to operate the partner programme and to prevent two partners claiming the same customer. Our partners are responsible under their partner agreement for having a lawful basis to share them with us.

Cookie choice

When you accept or decline analytics, we record that choice, the version of this policy it applied to, and a random identifier your browser generates. It contains nothing about you. Lawful basis: our legal obligation to be able to show that consent was given or refused.

On retention periods

We keep personal data only as long as we need it for the purpose it was given, or as long as the law requires. Some of the periods below are fixed by the system itself; others depend on how the relationship develops.

Fixed periods

Partner portal sign-in

24 hours, extended while you keep using it. Signing out ends it immediately.

Account confirmation link

48 hours.

Password reset link

1 hour, and it can only be used once.

Assessment in progress

2 hours. If you do not finish in that time, the answers are discarded and you start again.

Assessment report download link

30 days.

Invoicing records

8 years, as required by Hungarian accounting law.

Everything else

Enquiries, partner applications, meeting bookings, completed assessments and deal registrations are kept for as long as they remain commercially relevant — a record of a conversation is of little use if it disappears while the conversation is still going on. We review them periodically and delete what is no longer needed.

You can ask us to delete your personal data at any time, and where no contractual or legal obligation requires us to keep it, we will do so promptly. That includes your assessment answers and any report generated from them.

Where your data is stored

This website and the systems behind it run on servers we rent from Hetzner Online GmbH, in their Helsinki data centre. Both the provider and the data centre are inside the European Economic Area, so hosting this site involves no transfer of personal data to a third country.

Some of the services we rely on to answer you — described under “Third parties” below — are operated by companies based outside the EEA. Where that is the case, we only use providers that offer a transfer mechanism approved by the European Commission.

On personal data security

We respect your privacy, and safeguarding your personal data is embedded into our culture. We use a combination of industry-standard and good-practice methods to protect it.

Unfortunately, no website or app can guarantee complete security, but we put great effort into our application and data security. We use a range of technical, organizational, and administrative security measures proportionate to the risks of data processing. The computer systems we use to store your data have access limitations and are hosted with reputable vendors. We use encryption to protect your personal data when we transfer it across the internet and when we store it on our servers. We carry out security assessments and do due diligence on third-party vendors who handle your data.

To maintain a culture of privacy by design, we provide thorough data protection and privacy training to all Spirity employees. We develop our services with the goal of using the minimum amount of personal data possible, including through data minimization techniques such as anonymization and pseudonymization. Whenever we develop or update our services in ways that involve the collection or use of new forms of personal data, we conduct a balancing test to understand and reduce the likelihood of any unintended impact on you.

In addition to Spirity, in some cases the data may be accessible to certain types of persons in charge, involved with the operation of the website (administration, sales, marketing, legal, system administration) or to external parties — such as third-party technical service providers, mail carriers, hosting providers, IT companies, and communications agencies — appointed, where necessary, as data processors by Spirity. The updated list of these parties may be requested from Spirity at any time.

Miscellaneous information

Compliance with a legal obligation

Clients’ personal data may be used for legal purposes by Spirity in court, or in the stages leading to possible legal actions arising from improper use of the website or other related services. Clients and visitors declare to be aware that Spirity may be required to reveal personal data upon request of public authorities. Spirity only provides personal data if the requesting third party provides the proper and exact legal basis of its request.

Our legal claims

We may disclose your information where necessary to enforce the contract between Spirity and our clients or other agreements. We may also disclose your personal data if necessary to prevent, detect or prosecute illegal or suspected illegal activities, including fraud, or to prevent other damage, or where necessary in response to legally binding requests or legal action against us.

Maintenance and security logs

For operation and maintenance purposes, the website and third-party service providers may collect files that record interaction with the website and use other personal data (such as the IP address, or requests leading to errors) for this purpose.

About “Do Not Track” requests

Spirity does not support “Do Not Track” requests. To determine whether any of the third-party services it uses honour “Do Not Track” requests, please read their privacy policies.

Changes to our privacy policy

Spirity reserves the right to make changes to this privacy policy at any time by giving notice to its clients on this page, and — as far as technically and legally feasible — by sending a notice to clients via any contact information available to Spirity. It is strongly recommended to check this page often, referring to the date of the last modification listed at the top.

On personal data of visitors

As a visitor of our website, we will collect personal data on you as it is sent to us from your device or browser, or as we can observe as you browse. Any personal data we have on you will be deleted at the latest 365 days after collection.

We use personal data of visitors out of our legitimate interest to provide quality and secure services to you. Based on your consent, we will also collect usage statistics from our analytical cookies, to understand how you use our site.

During your visit we collect

• IP address and your region,
• information about your device and browser,
• third-party sites you visit when you leave our website,
• personal data provided via free-text message as a letter with a subject and additional exact personal data (name, email address) — on the contact page.

This can be by means of deletion, as in the case of our security logs, or by anonymization, as for site statistics. If you become one of our clients, we will continue to store your personal data on the legal basis of performing a contract.

Rights and questions

You may exercise certain rights regarding your data processed by Spirity:

• Withdraw your consent at any time where you have previously given consent to the processing of personal data, such as for our newsletter or analytical cookies.
• Object to processing of your data if the processing is carried out on a legal basis other than consent. Where personal data is processed for the purposes of our legitimate interests, you may object by providing a ground related to your situation. Should your personal data be processed for direct marketing purposes, you can object at any time without providing any justification.
• Access your data — learn whether data is being processed by Spirity, obtain disclosure regarding certain aspects of the processing, and obtain a copy of the data undergoing processing.
• Verify and seek rectification — verify the accuracy of your data and ask for it to be updated or corrected.
• Restrict the processing of your data under certain circumstances. In this case, Spirity will not process your data for any purpose other than storing it.
• Have your personal data deleted or otherwise removed, under certain circumstances.
• Lodge a complaint — bring a claim before your competent data protection authority.

Any request to exercise your rights can be directed to Spirity through the contact details provided in this document. These requests can be exercised free of charge and will be addressed as early as possible, and always within one month.

Cookies and local storage

This site sets no cookies of its own. What it does use is your browser’s local storage, which works similarly but stays on your device and is never sent to us automatically.

Strictly necessary

These cannot be turned off, because without them the site cannot remember decisions you have already made.

Your cookie choice

Records whether you accepted or declined analytics, so you are not asked on every page.

A random identifier

A value your browser generates so that a record of your consent decision can be matched to it. It is not derived from anything about you, and we never use it to recognise you elsewhere.

Partner portal session

Only if you sign in. It is the token that keeps you signed in, and it is removed when you sign out.

Theme preference

Whether you chose the light or dark appearance.

Analytics — only if you accept

Analytics load only after you accept them, and are switched off by default until you do. Declining is not a preference we record and then ignore: nothing is loaded and nothing is measured.

Google Analytics and Google Tag Manager (Google Ireland Limited)

Helps us understand which pages are useful and where people give up. It collects usage statistics and a device identifier, not your name or your messages.

Place of processing

European Union, with possible transfer to the United States under a European Commission-approved mechanism.

Changing your mind

Use the cookie settings link in the footer at any time; declining takes effect immediately.

Third parties

• We use a small number of specialist providers to run our infrastructure, answer enquiries and arrange meetings.
• We only use providers that offer protection comparable to what the GDPR requires.

We share personal data only if

• you explicitly authorize us to do so,
• it is necessary for our service — mostly for hosting, email and customer management,
• there are legal reasons (claims, or requests by authorities).

About our use of third-party data processors

These third parties only process your personal data under our instructions. We require all of our contracted third-party data processors to:

• process personal data only as instructed, or as we gave them explicit consent,
• have the necessary and obligatory security measures,
• demonstrate compliance with the applicable data protection laws,
• ensure authorized processing and confidentiality,
• only engage another processor with our acknowledgement,
• assist us in fulfilling our obligation as controller to respond to requests for exercising data subject rights.

We will put in place appropriate measures to ensure that personal data is adequately protected if the third-party data processor is outside of the European Economic Area.

Our third-party data processors

Hosting and infrastructure

Hetzner Online GmbH (Germany; servers in Helsinki, Finland) provides the servers that run this website, its API and its databases. Everything you send us through this site is stored there — https://www.hetzner.com/legal/privacy-policy

Email and meetings

Microsoft Ireland Operations Limited (Microsoft 365) delivers the email we send you, hosts the calendars behind our meeting booking, and provides the online meeting links in your invitation — https://privacy.microsoft.com/privacystatement

Customer relationship management

Rapidops, Inc. (Salesmate) holds the record of your enquiry so the right colleague can follow it up. Rapidops is based in the United States and processes data under a European Commission-approved transfer mechanism — https://www.salesmate.io/privacy-policy/

Website analytics

Google Ireland Limited (Google Analytics and Google Tag Manager) helps us understand how the site is used. These load only after you accept analytics cookies, and not at all if you decline — https://policies.google.com/privacy

The competent supervisory authority

For complaints and exercising your data subject rights, please first reach out to us at hello@spirity.hu. If we cannot adequately address your concern, you can contact the Hungarian National Authority for Data Protection and Freedom of Information.

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

Hungarian National Authority for Data Protection and Freedom of Information

Address

H-1125 Budapest, Hungary, Szilágyi Erzsébet fasor 22/c.

Phone

+36 1 391 1400

Fax

+36 1 391 1410

E-mail

privacy@naih.hu or ugyfelszolgalat@naih.hu

Web

https://www.naih.hu

Terms, definitions and their meanings

The legal and technical terms used throughout this privacy policy.

Client

Any natural or legal person who enters into a contract with Spirity Enterprise Zrt.

Cookies

A cookie is a small data file stored on your computer or device. Cookies record things like your preferences and settings, helping give us the information we need to provide a consistent and relevant experience. They consist of portions of code installed in the browser that assist Spirity in providing our service. Some services for which cookies are installed may also require the visitor’s consent; where installation is based on consent, such consent can be freely withdrawn at any time.

Analytical cookies

Snippets of code placed in the page to measure things like clicks and other interactions. We use them to find out more about how you interact with our services, how you found our page, and more generally how you use us.

Data controller

The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data, including the security measures concerning the operation and use of the website. The data controller, unless otherwise specified, is Spirity Enterprise Zrt.

Data processor

The natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller, as described in this privacy policy.

Data subject

The natural person to whom the personal data refers.

European Union (or EU)

Unless otherwise specified, all references made within this document to the European Union include all current member states of the European Union and the European Economic Area.

Personal data

Any information that directly, indirectly, or in connection with other information — including a personal identification number — allows for the identification or identifiability of a natural person. This includes information that may of itself identify you, such as your name, contact details, IP address, cookie strings or device IDs, as well as information that may not on its own identify you but which we store alongside such identifiers.

Service

All services provided by Spirity Enterprise Zrt.

Third party

Any natural or legal person who does not have a direct connection with a legal transaction but who might be affected by it. In the case of Spirity’s services, a third-party individual is a natural or legal person who is not in direct connection with the legal relations between Spirity and the data subject.

Usage statistics

Information collected automatically through the website (or third-party services employed in it), which can include: the IP addresses or domain names of the computers used by visitors, the URI addresses, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server’s answer, the country of origin, the features of the browser and operating system used, the various time details per visit, and the details about the path followed within the service. Usage statistics can be anonymous, or more detailed if you consent to the use of analytical cookies.

Visitor

A natural or legal person who visits the website or contacts Spirity.

Web beacons and pixels

Small, transparent image files inside a web page or email. We use them to understand how you interact with our services, or if you have been redirected to a different website or app. We also use pixels to gather information such as whether you have opened an email, so that we can improve our communications to you.