Privacy Notice
This notice explains which personal data we process when you visit emmo.hu or contact us, for what purposes, on what legal basis and for how long, and what rights you have. It is based on Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Hungarian Act CXII of 2011 on the right to informational self-determination and freedom of information (Infotv.).
1. The controllers
The emmo.hu website is operated by two sister companies that jointly determine the purposes and means of the processing related to the website and to contact enquiries; they are therefore joint controllers within the meaning of Article 26 GDPR:
| Emmo Systems Kft. | Emmo Systems Korlátolt Felelősségű Társaság Registered seat: 1148 Budapest, Padlizsán utca 35. I. em. 6. Company reg. no.: 01-09-891679 · Tax no.: 14161397-2-42 |
|---|---|
| Emmo Services Kft. | Emmo Services Korlátolt Felelősségű Társaság Registered seat: 6034 Helvécia, Kecskeméti út 44. Company reg. no.: 03-09-140555 · Tax no.: 27272875-2-03 |
| Single point of contact | hello@emmo.hu (on behalf of both controllers; by post to either registered seat) |
Essence of the joint controller arrangement
- Emmo Systems Kft. is responsible for the technical operation of the website and the mail system and for the security measures.
- Incoming enquiries are received in the shared hello@emmo.hu mailbox and answered by the company whose business the enquiry concerns. Data is shared between the two companies only to the extent needed to handle the enquiry.
- Both companies are jointly responsible for informing data subjects and for enabling the exercise of their rights. You may exercise your rights in respect of and against either controller (Article 26(3) GDPR); the simplest way is to write to the shared address hello@emmo.hu.
- We are not required to designate a data protection officer under Article 37 GDPR; for any privacy matter please use the shared contact above.
2. What data we process, why and for how long
2.1. Contact form
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, e-mail address, subject (optional), message text; technical data: time of submission, selected language, the visitor's IP address and browser identifier (user agent), and a salted hash derived from the IP address. | Answering your enquiry, preparing a quotation, pre-contractual discussions; preventing abuse of the form (spam, bulk submissions). | For quotation requests and contract preparation: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR). For general enquiries and abuse protection: the controllers' legitimate interest (Article 6(1)(f) GDPR). | The IP hash for at most 1 hour. The message and your details for 1 year after the matter is closed; if a contract is concluded, under the rules applicable to contract documents (accounting records for 8 years under Section 169 of Hungarian Act C of 2000 on Accounting). |
How the form works: the form sets no cookies on your device. The web server forwards your message by e-mail to the hello@emmo.hu mailbox; it is not stored in a database on the web server. To filter out abuse (for example mass submissions within seconds), the web server derives a salted hash from your IP address, keeps it for at most one hour and then deletes it automatically; the IP address cannot be reconstructed from it. To keep abuse traceable, the forwarded e-mail also contains your IP address and browser identifier; these are kept together with the message, for the message's retention period. The form is also protected by Google reCAPTCHA v3, described in Section 3.
Your name, e-mail address and message are required to use the form; without them we cannot receive your enquiry. By ticking the checkbox under the form you confirm that you have read this notice; this is not consent, the legal basis of the processing is set out in the table above.
2.2. Enquiries sent directly by e-mail
If you write directly to hello@emmo.hu, the data you provide in the e-mail (sender name and address, content of the message, attachments, technical e-mail headers) is processed for the same purposes, on the same legal bases and for the same period as messages sent through the form.
2.3. Web server logs
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| IP address, time of the request, requested URL, HTTP status, browser identifier (user agent), referring page. | Secure and error-free operation of the website, detection of attacks and abuse, troubleshooting. | The controllers' legitimate interest in the security of the service (Article 6(1)(f) GDPR). | At most 9 days (automatic log rotation), or until the investigation of a security incident is closed. |
2.4. Cookies and fonts
The website does not use cookies of its own and uses no analytics or marketing trackers. The Exo 2 typeface is served from our own server, so no connection to, or data transfer to, Google Fonts takes place. The only external service is Google reCAPTCHA protecting the contact form, which may set a cookie (see Section 3).
3. Google reCAPTCHA v3
We protect the contact form against automated abuse (bots, spam) with Google reCAPTCHA v3. Provider: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).
- When it is loaded: the website loads the reCAPTCHA script from Google's servers only once you start using the form (clicking into a field or typing). Simply viewing the page does not connect to Google.
- What it collects: reCAPTCHA v3 works in the background without a challenge and assigns a score based on the visitor's behaviour. In doing so Google may process in particular your IP address, browser and device information (user agent, screen resolution, language, plug-ins), the URL of the page visited, mouse and touch movements, keystroke timing and, if you are signed in to a Google account, Google cookies. The one-time token created on submission is verified by our server with Google; we use the returned score only to accept or reject the submission and do not store it permanently.
- Cookies: once loaded, Google may set a cookie (typically
_GRECAPTCHAon the google.com domain, valid for about 6 months) used for abuse detection. - Legal basis: the controllers' legitimate interest in protecting the form and the mail system against spam and automated attacks (Article 6(1)(f) GDPR). If you prefer not to use reCAPTCHA, please e-mail us directly at hello@emmo.hu.
- Transfers to third countries: Google may also transfer the data to its servers in the United States (Google LLC). Google LLC participates in the EU–U.S. Data Privacy Framework, for which the European Commission adopted adequacy decision (EU) 2023/1795 of 10 July 2023 (Article 45 GDPR); in addition, Google applies standard contractual clauses (Article 46 GDPR).
- Further information: Google Privacy Policy, Google Terms of Service, about reCAPTCHA.
Automated decision-making: based on the reCAPTCHA score our server may reject a suspicious submission; this has no legal or similarly significant effect on you, as you can always send your enquiry directly by e-mail.
4. Who has access to the data?
The data is accessible to those staff of the two controllers who need it to handle your enquiry. The website and e-mail run on the companies' own servers operated in Hungary; we use no external hosting, cloud or e-mail provider (processor). In the course of operating reCAPTCHA, Google processes data in accordance with its own privacy policy (see Section 3). Where an authority or court requests data on a legal basis, we disclose the requested data within the limits of our legal obligations.
5. Data security
We receive your data over an encrypted (HTTPS/TLS) connection and protect personal data against unauthorised access, alteration and destruction by access restrictions, logging, regular updates and backups. The controllers design their information security measures along the principles of the ISO 27001 standard.
6. Your rights
Under Chapter III GDPR you have the following rights regarding your personal data:
- Access (Article 15): you may ask whether we process your personal data and request a copy of it.
- Rectification (Article 16): you may ask us to correct inaccurate data or complete incomplete data.
- Erasure (Article 17): you may ask us to delete your data where it is no longer needed for the purpose or the processing is unlawful; data subject to a statutory retention obligation cannot be deleted before the period expires.
- Restriction of processing (Article 18): in the cases set out in the Regulation you may ask that we only store, but not otherwise process, your data.
- Data portability (Article 20): you may receive the data processed by automated means in the context of contract preparation in a structured, commonly used, machine-readable format.
- Objection (Article 21): you may object at any time, on grounds relating to your particular situation, to processing based on legitimate interest; we will then process the data further only on compelling legitimate grounds.
How to exercise your rights: send your request to hello@emmo.hu or by post to the registered seat of either controller. We may ask you to verify your identity before fulfilling the request. We respond without undue delay and in any event within one month of receipt; this period may be extended by a further two months where necessary, taking into account the complexity and number of requests, in which case we inform you within one month of receipt. Information and action are provided free of charge, except for manifestly unfounded or excessive requests.
7. Remedies
If you believe that the processing of your personal data infringes the GDPR or the Infotv., please contact us first at hello@emmo.hu so that we can resolve the matter quickly. You also have the right to lodge a complaint with the supervisory authority:
- Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH)
- Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
- Postal address: 1363 Budapest, Pf.: 9., Hungary
- Phone: +36 (1) 391-1400
- E-mail: ugyfelszolgalat@naih.hu
- Website: https://naih.hu/
You also have the right to an effective judicial remedy (Article 79 GDPR, Section 23 Infotv.). Such proceedings fall within the competence of the regional courts (törvényszék); at your choice you may also bring the action before the regional court competent for your place of residence or stay.
8. Changes to this notice
This notice is effective from 21 October 2026. We may amend it when the legal environment or our processing practices change; the current version is always available on this page. Our company details are set out in the Imprint.