Privacy Policy

This is the English version of our privacy policy. The Hungarian version (Adatkezelési tájékoztató, https://www.andronia.com/adatvedelem) prevails in case of any difference.

1. Data controller

Andronia Korlátolt Felelősségű Társaság (Andronia Kft.)
Registered office: Szobor utca 4, Building A, 7th floor, Door 702, 1138 Budapest, Hungary
Company registration number: 01-09-449086
Email: office@andronia.com
Website: https://www.andronia.com

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Infotv.).

2. What we process and why

2.1. Contacting us by email

• Data: name, email address, message content, and any other data shared in the correspondence.
• Purpose: replying to your enquiry and preparing proposals.
• Legal basis: steps prior to entering into a contract (Art. 6(1)(b) GDPR); for other enquiries, our legitimate interest in replying (Art. 6(1)(f) GDPR).
• Retention: if the enquiry leads to a contract, as set out in 2.5; otherwise 1 year after the enquiry is closed.

2.2. Booking a call

• Data: name, email address, the chosen time slot, and any note added when booking.
• Purpose: arranging and holding the consultation.
• Legal basis: steps prior to entering into a contract (Art. 6(1)(b) GDPR).
• Retention: 1 year after the consultation, or until you ask us to delete it.
• Bookings are made at booking.andronia.com, run on TidyCal (section 3).

2.3. AI assessment (guide quiz)

• Data: your answers to the quiz questions. We do not ask for your name, email address or any other identifying data.
• Purpose: generating a personalised summary from your answers.
• How it works: our server forwards your answers to OpenAI, which generates the summary. We do not store the answers or link them to you. OpenAI does not use submitted data to train its models and may retain it for up to 30 days for abuse monitoring.
• Legal basis: our legitimate interest in providing the service you requested (Art. 6(1)(f) GDPR).

2.4. Running the website and visitor statistics

• Server logs: our hosting provider logs technical data (IP address, browser type, time of request) to operate and secure the website. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Retention: up to 30 days.
• Statistics: we measure traffic with Plausible Analytics and Vercel Web Analytics. Both work without cookies, do not identify visitors and do not track them across other websites; we only see aggregated data (for example page views, referring site, country, device type). Legal basis: our legitimate interest in improving the website (Art. 6(1)(f) GDPR).

2.5. Contact persons of clients and business partners

• Data: the contact person’s name, position, email address, phone number, and correspondence created while performing the contract.
• Purpose: concluding and performing the contract, and staying in contact.
• Legal basis: our and the client’s legitimate interest in maintaining the business relationship (Art. 6(1)(f) GDPR); where the contracting party is the individual, performance of the contract (Art. 6(1)(b) GDPR).
• Retention: 5 years after the contract ends (the general limitation period under the Hungarian Civil Code).

2.6. Invoicing

• Data: the data shown on invoices (name, address, tax number, service and fee details).
• Purpose: meeting our accounting and tax obligations.
• Legal basis: legal obligation (Art. 6(1)(c) GDPR), under Section 169 of the Hungarian Accounting Act (Act C of 2000) and the Hungarian VAT Act (Act CXXVII of 2007).
• Retention: 8 years.
• Invoices are issued with Billingo (section 3).

2.7. Payments

• Card and other online payments are processed by Wise Europe SA (individual payment links) and, for recurring fees, by Stripe Payments Europe Ltd. We never see or store card details; the payment provider processes them as an independent controller under its own privacy policy. If the payer pays from their own Wise account, the Wise company serving that payer also processes their data.
• We receive confirmation of the payment and its reference data (payer name, amount, date, transaction status).
• Legal basis: performance of the contract and legal obligation (Art. 6(1)(b) and (c) GDPR). Retention: as in 2.6.

2.8. Follow-ups

• Data: name, email address, and the content of earlier correspondence and meetings.
• Purpose: sending personal follow-up messages about an earlier enquiry, consultation or proposal. We do not send newsletters or bulk marketing emails.
• Legal basis: our legitimate interest in establishing a business relationship (Art. 6(1)(f) GDPR).
• Retention: 1 year after the last contact. You can object to follow-ups at any time at office@andronia.com or by replying to the message; we will not contact you again after that.

3. Processors and recipients

The following providers process data on our behalf, under a written data processing agreement and only on our instructions:

Provider (country)	Role
Vercel Inc. (USA)	hosting, server logs, Vercel Web Analytics
Plausible Insights OÜ (Estonia)	visitor statistics
OpenAI Ireland Ltd. (Ireland)	generating the AI assessment summary
Microsoft Ireland Operations Ltd. (Ireland)	email (Microsoft 365)
TidyCal: Sumo Group Inc. (USA)	call booking
Billingo Technologies Zrt. (Hungary)	invoicing
ClickUp: Mango Technologies, Inc. (USA)	project management
Slack Technologies Limited (Ireland)	internal communication
external accountant (Hungary)	bookkeeping, tax filings

Acting as independent controllers when processing payments: Wise Europe SA (Belgium) and Stripe Payments Europe Ltd. (Ireland).

We also use AI assistants (Claude, ChatGPT) in our work, with model training turned off. We do not enter personal data into these tools. Where a task involves personal data, we anonymise it first, or carry out the task through API access covered by a data processing agreement.

4. Transfers outside the European Economic Area

Some providers (Vercel Inc., Sumo Group Inc., Mango Technologies, Inc., and the US affiliates of OpenAI, Slack and Microsoft) may process data in the United States. Transfers rely on the adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the Standard Contractual Clauses adopted by the European Commission (Art. 44-49 GDPR).

5. Cookies

This website does not place cookies or similar identifiers on your device, so we do not ask for cookie consent. The booking page (booking.andronia.com) runs on TidyCal and may use its own cookies to function. External links on the website (for example LinkedIn, Instagram) are governed by those sites’ own privacy policies.

6. Automated decision-making

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you. The AI assessment summary is for information only.

7. Your rights

You have the right to:

• access your personal data (Art. 15 GDPR);
• have it rectified (Art. 16) or erased (Art. 17);
• restrict its processing (Art. 18);
• data portability (Art. 20), where applicable;
• object to processing based on legitimate interest (Art. 21);
• withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.

Send requests to office@andronia.com; we respond within one month.

If you believe our processing infringes your rights, you can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH; Falk Miksa utca 9-11, 1055 Budapest; postal address: 1363 Budapest, Pf. 9.; ugyfelszolgalat@naih.hu; https://naih.hu), or go to court, including the regional court of your place of residence or stay.

8. Security

We transmit data over encrypted connections, and only people who need it for their work have access. We choose our providers based on their data security guarantees.

9. Changes to this policy

We update this policy when necessary; the current version is always available at https://www.andronia.com/privacy.