Privacy notice

This notice is addressed to visitors of bidcraft.hu and to persons who contact BidCraft by e-mail. It covers the current operation of the website: contact requests, secure operation of the site, and — where consent is given — Google Analytics 4 traffic measurement.

1. Controller

Name

Vass Dávid, sole trader

Registered seat

1095 Budapest, Gát utca 21. fszt. 1.

Registration number

59372008

Tax number

90218000-2-43

E-mail

bidcraft@openvillage.io

Website

bidcraft.hu

2. Principles of processing

The controller processes personal data for specified, explicit and legitimate purposes and only to the extent necessary for those purposes. Processing follows the principles of data minimisation, accuracy, confidentiality, integrity and storage limitation.

3. Contact by e-mail

If a data subject contacts BidCraft at bidcraft@openvillage.io, we process the data provided in the e-mail to reply to the enquiry, for professional or business discussions and — where relevant — for steps prior to entering into a contract.

Data processed

name, e-mail address, message content, and any organisational or contact details voluntarily provided by the data subject

Purpose

replying to the enquiry, professional or business discussion and, where needed, taking steps prior to entering into a contract

Legal basis

Article 6(1)(b) GDPR if the data subject initiates contracting in their own name or asks for pre-contractual steps for their own contract; for enquiries sent on behalf of or as a contact for an organisation, or other professional/business enquiries, Article 6(1)(f) GDPR: the controller’s legitimate interest in handling the enquiry, business communication and maintaining the relationship

Legitimate interest

substantive handling of professional and business enquiries received by the controller, responding to contact requests and ensuring any necessary discussion

Retention

for general contact requests, up to 1 year after the matter is closed; if a contractual relationship is formed, necessary data may be retained further as required by applicable statutory retention rules

Provision of data

voluntary; without an e-mail address or other contact details needed to reply, we cannot respond to the enquiry

Recipients

the mail provider that delivers e-mail and operates mailbox technology; where needed for technical operation, the hosting provider

4. Technical log data

When serving the website, the server may process technical log data. These typically include the IP address, time of the request, requested resource, technical details of the browser and operating system, and error information.

Purpose

ensuring secure and stable operation of the website, troubleshooting, and detecting abuse and IT incidents

Legal basis

legitimate interest under Article 6(1)(f) GDPR for secure operation of the service

Legitimate interest

ensuring the security, availability and fault-free operation of the website and related IT infrastructure

Retention

up to 30 days, unless a longer period is needed to investigate a security event or abuse, or for a legal claim

Recipient

RackForest Zrt. for hosting and server infrastructure

5. Google Analytics 4

The website uses Google Analytics 4 to measure traffic and analyse how the site is used. Analytics measurement starts only after the data subject’s prior consent. Until consent is given, BidCraft keeps Google Analytics measurement disabled.

During measurement, Google Analytics may process page views and event data, device and browser characteristics, approximate geographic data and technical identifiers related to the session. For users from the European Union, Google may use the IP address to determine geographic data and then discards it before logging; according to Google, Google Analytics does not log or store the IP address.

Purpose

statistical measurement of website traffic, use and performance, and improving content and user experience

Legal basis

consent under Article 6(1)(a) GDPR

Provider / processor

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

GA4 retention

user-level and event-level data retention period is 14 months

Data sharing with Google products

BidCraft keeps the Google Analytics “Google products & services” data-sharing setting turned off

Analytics cookies — After consent is given, Google Analytics may place first-party analytics cookies. According to Google’s documentation, the default expiry of the _ga and _ga_<id> cookies is 2 years. They are used to distinguish visitors and sessions for statistics.

Managing consent — On the first visit, the visitor may decide whether to allow analytics measurement. If consent is refused, analytics measurement does not start. To remember the choice, the website may use only the technical storage needed to record the consent setting. Consent may be withdrawn or changed at any time later; withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

International transfers — Google operates a global infrastructure, so Google Analytics data may in some cases be processed outside the European Economic Area. For transfers to the United States to Google LLC, the adequacy decision under the EU–US Data Privacy Framework may apply if the recipient is an active participant. Google LLC is currently listed among Data Privacy Framework participants. Where the adequacy decision does not apply to a transfer, Google may also rely on the European Commission’s standard contractual clauses as an appropriate safeguard.

Further information on safeguards for international transfers is available in Google’s data-transfer notices and in the EU–US Data Privacy Framework register.

6. Recipients, processors and service providers

Under Article 13 GDPR, this notice may also identify categories of recipients. The specific mail provider for the bidcraft@openvillage.io mailbox is determined by the production configuration; the category means the provider that delivers and stores e-mail.

7. Automated decision-making and profiling

In the current operation of bidcraft.hu, no automated decision-making that produces legal effects concerning the data subject or similarly significantly affects them takes place. The website does not create individual profiles with legal effects from analytics data.

8. Rights of the data subject

Under the GDPR, the data subject may request access to personal data concerning them, and rectification, erasure or restriction of processing. Where applicable, they also have the right to data portability. Where processing is based on legitimate interest, the data subject may object on grounds relating to their particular situation.

Consent given for processing based on consent may be withdrawn at any time. Requests to exercise these rights may be sent to bidcraft@openvillage.io. The controller handles the request without undue delay and, as a rule, within one month of receipt.

9. Remedies

If the data subject considers that the processing of their personal data infringes data-protection law, they may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or bring proceedings before a court.

Authority

Hungarian National Authority for Data Protection and Freedom of Information

Address

1055 Budapest, Falk Miksa utca 9-11.

Postal address

1363 Budapest, Pf. 9.

E-mail

ugyfelszolgalat@naih.hu

Phone

+36 1 391 1400

Website

naih.hu

10. Data security

The controller applies technical and organisational measures appropriate to the nature and risks of processing to protect personal data against unauthorised access, alteration, disclosure, erasure or loss. The website uses encrypted HTTPS connections.

11. Changes to this notice

The controller may amend this notice when the website’s operation, the services used or the legal framework change. The version in force is always available on bidcraft.hu.

Effective: 3 August 2026

Legal background: Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.), and the applicable provisions of Act C of 2003 on Electronic Communications, in particular rules on storing and accessing information on terminal equipment.