PROGNEX AUTOMATION / PRIVACY NOTICE
Privacy notice
Personal data and communication
Information about the personal data processed when you contact us by email or phone and when the website operates, and about your rights.
Last updated: 22 October 2026.
1. The controller
- Company name
- Prognex Automation Kft.
- Registered office
- 9027 Győr, Puskás Tivadar u. 41.
- Managing director authorised to represent the company
- Jámbor Tamás
- Company registration number
- 08-09-034263
- Tax number
- 27780712-2-08
- prognex@prognex.hu
- Phone
- +36 20 519 7589
- Website
- prognex.hu
You can contact us about data protection questions and requests concerning personal data at the email or postal address above.
2. What does this notice cover?
This notice covers data relating to visitors to prognex.hu, individuals who contact us by email or phone, and contact persons at partner companies. It explains the processing associated with enquiries, requests for quotations and the website’s technical operation, and how documents needed for a contract or statutory retention are distinguished from general enquiries.
The website has no contact or quotation request form, file upload, user registration or newsletter subscription. The website’s own application does not maintain a visitor customer database. You can contact us by email or phone.
Data about a company that is a legal person are not, in themselves, personal data. However, the name of its representative or employee and business contact details that identify that person may constitute personal data.
3. Contacting us by email or phone
An email link opens the visitor’s email application. We receive the contents of the email when the sender sends the message. We process the enquiry to answer the question, understand the technical requirements and discuss a possible quotation.
We do not record telephone calls or keep separate customer notes or records of their contents. We use the information provided by phone for the discussion. If the discussion continues by email, the rules for email processing apply to the message sent.
4. Purposes and legal bases for processing
- An enquiry from an individual or sole trader about their own potential contract
- Processing necessary to prepare a quotation and contract at the data subject’s request: Article 6(1)(b) GDPR.
- An enquiry from a partner company’s representative or employee; other general business enquiries
- Answering enquiries and arranging business discussions: Prognex’s legitimate interests, Article 6(1)(f) GDPR. A contract with a partner company does not make its contact person a party to that contract personally.
- A document needed to perform a contract
- For a contracting party who is a natural person: Article 6(1)(b) GDPR. For a partner company’s contact person: the legitimate interest in carrying out the contractual cooperation, Article 6(1)(f) GDPR.
- Statutory document retention
- Compliance with the legal obligation requiring retention of the specific document: Article 6(1)(c) GDPR.
- Evidence needed for a specific legal claim
- The legitimate interest in retaining evidence needed to assert or defend a claim: Article 6(1)(f) GDPR.
- Temporary technical retention of deleted emails
- The legitimate interest in preventing data loss caused by accidental or malicious deletion: Article 6(1)(f) GDPR. The configured period is described in section 6.
- Website delivery and security
- The legitimate interest in website availability, handling faults and preventing misuse: Article 6(1)(f) GDPR.
We limit processing based on legitimate interests to the data and period necessary for the purpose, taking account of the data subject’s reasonable expectations and the impact on their privacy. Information about the balancing of interests can be requested at our contact address. You may object to processing based on legitimate interests as described in section 10.
We do not treat sending an email as general consent to data processing or marketing.
5. What data do we process, and where do they come from?
Depending on the contents of the enquiry, we receive the following data:
- name, the company represented and the person’s role as a contact;
- email address, phone number and other business contact details provided;
- parts of the message, technical discussion and attachments that contain personal data;
- sender, recipient and timestamp information associated with the correspondence.
We request only the data needed for the enquiry. Please do not send unnecessary identity documents, health data or other sensitive personal information.
Data generally come from the data subject. If another employee of a partner company provides the contact person’s details, we inform the data subject about the source and processing of their data no later than our first contact and, in any event, within one month, except where the law provides otherwise.
Technical data transmitted when visiting the website are described in section 9.
6. Retention periods and erasure
General email enquiries
We retain personal data associated with general email enquiries for 90 days from receipt of the individual email, then delete them. Deletion also covers the Deleted Items folder.
The 90 days do not run from closure of the matter or the date of the last reply. A further reply or enquiry does not restart the retention period of an earlier incoming email. Each newly received email has its own retention period starting on receipt.
Contractual documents and documents subject to statutory retention
If an enquiry leads to a contractual relationship, we process the data necessary to perform that contract for as long as performance requires. This does not automatically justify retaining all earlier correspondence for longer.
Documents that qualify as accounting vouchers or supporting accounting records must be retained for at least eight years under section 169 of Hungarian Act C of 2000 on Accounting. This obligation applies to the relevant record and its supporting data, not to every business email.
For a specific legal claim, only data necessary to assert or defend that claim may be retained, taking account of the applicable limitation period and related proceedings. The general limitation period under the Hungarian Civil Code is five years, normally starting when the claim becomes due. This does not impose a mandatory five-year retention period on all emails. Suspension or interruption of limitation, or a different statutory rule, may alter the period applicable to a particular claim.
Technical copies remaining in the email system
The Microsoft 365 email system is configured with a 14-day technical retention period after removal from Deleted Items. This protects against data loss caused by accidental or malicious deletion. Single item recovery is enabled: an email that a user has also removed from Recoverable Items may still be recoverable by an administrator until the retention period expires. After that period, removal is carried out by the provider’s automated processing.
Technical retention is separate from the 90-day business processing of general enquiries. The 90-day rule is not a promise of immediate physical destruction across every system and backup.
7. Processors and recipients
Website: OpenAI
The website’s hosting provider is OpenAI Ireland Limited, with its registered office at 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland.
For personal data processed on behalf of Prognex in connection with operating the published website, Prognex is the controller and OpenAI is the processor. The relevant terms are set out in the ChatGPT Sites Data Processing Addendum. The provider may engage subprocessors in accordance with its published subprocessor list. Cloudflare infrastructure also contributes to website delivery and security.
Data subjects can direct website-related data protection requests to Prognex. Where necessary, we obtain OpenAI’s assistance in fulfilling those requests.
Email: Microsoft 365
The provider under Prognex’s Microsoft Customer Agreement is Microsoft Ireland Operations Limited. Its address for contractual notices is One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.
Email for prognex@prognex.hu operates through Microsoft 365. Microsoft acts as a processor for operations carried out on behalf of Prognex to receive, transmit and store emails and operate the email service. This covers message and attachment contents, sender and recipient data, and technical delivery information. The provider’s terms are described in the Microsoft Products and Services Data Protection Addendum.
Providers’ roles must be distinguished for each operation: processing for their own customer billing or contractual relationships is different from processing Prognex visitor data and email contents. A provider’s independent processing is governed by its own privacy information; this does not replace Prognex’s responsibility for the processing described here.
Where required by law and supported by an appropriate legal basis, data may also need to be disclosed to a court or authority. We limit disclosure to the data necessary for the particular proceedings.
8. International data transfers
According to the Microsoft tenant settings, the current and committed storage region for the relevant Exchange Online customer data at rest is the European Union/EFTA region. This storage information alone does not impose a geographical restriction on every processing operation or instance of remote access.
The operations of OpenAI, Microsoft and their subprocessors may involve processing or access outside the European Economic Area.
The OpenAI Sites data processing terms specify safeguards based on applicable adequacy decisions or the European Commission’s standard contractual clauses. Microsoft’s Data Protection Addendum also sets out contractual safeguards for international data transfers. An adequacy decision applies only to recipients and transfers within its scope.
Information about the safeguards used and how to obtain a copy can be requested at Prognex’s contact address. Provider documents are available through the links in section 7.
10. Your rights
Where the legal conditions are met, you may request access to and a copy of your personal data, rectification of inaccurate data, erasure or restriction of processing. The right to erasure does not override statutory retention duties or lawful processing needed for a legal claim.
You may object to processing based on legitimate interests on grounds relating to your particular situation. Processing may then continue only where compelling legitimate grounds that override your interests have been demonstrated, or to the extent necessary for a legal claim.
Under the GDPR’s conditions, data portability applies to data provided by the data subject where processing is based on consent or a contract and carried out by automated means; it does not automatically apply to all data.
You can send your request by email or post. We will inform you of the action taken without undue delay, normally within one month. For complex or numerous requests, this may be extended by a further two months; we will notify you of the extension and the reasons within the first month. If we refuse a request, we explain the decision and provide information about remedies. Where there are reasonable doubts about identity, we may request the additional information needed. Exercising your rights is generally free of charge.
11. Complaints and judicial remedies
If you believe that we are processing your personal data unlawfully, you may contact the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH).
- Address
- 1055 Budapest, Falk Miksa utca 9–11.
- Postal address
- 1363 Budapest, Pf. 9.
- Phone
- +36 1 391 1400
- Customer service email
- ugyfelszolgalat@naih.hu
- Website
- naih.hu
- Initiating proceedings electronically
- NAIH – initiate proceedings online
The customer service email address is not the electronic submission channel for initiating proceedings. To initiate proceedings, use the NAIH’s official electronic, postal or in-person submission route, as explained on the Authority’s contact page.
You may also seek a judicial remedy under the GDPR. You do not have to complain to Prognex first before seeking a remedy from an authority or court.
12. Data security
The website is accessible over HTTPS, and its delivery also uses Cloudflare security protection. Email operates through Microsoft 365. The applicable data processing terms set out the processors’ security and confidentiality obligations.
As controller, we must provide protection appropriate to the risks of processing and handle personal data breaches under the applicable rules. HTTPS protects traffic between the browser and the web server; it does not, by itself, provide end-to-end encryption of email correspondence.
13. Providing data and automated decisions
Contacting us is voluntary. We need suitable contact details to reply and a sufficient task description for technical discussions; without these, we may be unable to respond or provide a quotation.
The website’s own functions do not make decisions based solely on automated processing that produce legal or similarly significant effects on the data subject. The hosting security system may automatically assess network requests and apply checks or blocking to certain requests.
14. Effective date and updates
This notice takes effect when published on the website. We update it when there are material changes to processing or services. We provide information about any new processing purpose before further processing data for that purpose. Changing the text does not, in itself, create a new legal basis or extend the 90-day retention period of individual emails.