Privacy notice
Effective: 5 October 2026
1. Introduction
This notice explains how we handle your personal data when you visit the uptools.io website or its Hungarian pages under uptools.io/hu/, when you contact us, and when you use the services available on the website. It is based on the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) and Hungarian Act CXII of 2011 on informational self-determination and freedom of information (Infotv.). The Hungarian version prevails.
We treat your personal data confidentially and protect it with technical and organisational measures. A related document is our General Terms and Conditions.
2. The controller
| Item | Details |
|---|---|
| Name | upTools Kft. |
| Registered office | 8220 Balatonalmádi, Árpád utca 17., Hungary |
| Registry court | Veszprémi Törvényszék Cégbírósága (Court of Registration of the Veszprém Regional Court) |
| Company registration number | 19-09-524059 |
| Tax number | 32380356-2-19 |
| [email protected] | |
| Website | uptools.io |
For data protection questions or to exercise your rights, write to [email protected]. We have not appointed a data protection officer.
3. What we process
3.1. Contact form and email
| Aspect | Information |
|---|---|
| Data subjects | Anyone who contacts us through the form, at [email protected] or at [email protected]. |
| Data processed | Name, email address, topic, urgency, message; if you provide them, your company name or website and the size of your system. For a form on a service page, the source of the form. For a security report (the “Security report” topic or [email protected]), also the description of the reported issue, such as the affected address and the steps to reproduce it. If you turn on panic mode, we record that you accepted the related surcharge. This is not consent to data processing. For email, the data you give us and the data of the correspondence. |
| Purpose | Answering your enquiry, making an offer and preparing a contract. For a security report, investigating and fixing the reported issue and keeping the reporter informed. |
| Legal basis | If you contact us on behalf of a company: legitimate interest, GDPR Article 6(1)(f). If you act in your own name, for example as a sole trader: steps taken at your request before entering into a contract, GDPR Article 6(1)(b). For a security report: our legitimate interest in the security of our systems, GDPR Article 6(1)(f). |
| Retention | As long as needed to handle the enquiry, but no longer than 1 year from the last contact. If a contract is concluded, the related data is kept according to contractual and accounting rules. |
| Recipients and processors | Emails are delivered through Amazon Web Services. The [email protected] and [email protected] mailboxes run on a server we operate ourselves. Cloudflare may also take part in transmitting the traffic and delivering the emails. |
| Transfers outside the EU | Data may reach the USA through Cloudflare’s network. The safeguards are described in section 4. |
The form is protected from spam by a hidden field; this requires no additional personal data. If you have consented to measurement, sending the form records a generate_lead event with the topic, but the content of the form is not sent to the measurement system.
3.2. Server logs
| Aspect | Information |
|---|---|
| Data subjects | Visitors to the website. |
| Data processed | IP address, time of the request, requested page, response code and size, referring page and browser type. |
| Purpose | Running the website securely, detecting attacks and errors. |
| Legal basis | Legitimate interest, GDPR Article 6(1)(f). |
| Retention | 30 days. |
| Recipients and processors | Our server and cloud providers (section 4) and Cloudflare. We operate the servers ourselves. |
| Transfers outside the EU | Traffic passes through Cloudflare’s network, so the IP address may reach the USA; the same applies to our US-based server and cloud providers. The safeguards are described in section 4. |
3.3. Storing your cookie choice
We use our own cookie banner. Your choice is stored in your browser’s localStorage under the name upt-consent. This is not a cookie. Measurement and advertising services are blocked by default.
| Aspect | Information |
|---|---|
| Data subjects | Visitors to the website. |
| Data processed | Your cookie choice, stored locally by your browser. |
| Purpose | Remembering and applying your choice on the website. |
| Legal basis | Legitimate interest in managing the consent choice and running the website, GDPR Article 6(1)(f). |
| Retention | It does not expire: it stays in your browser until you change your choice or clear your browser’s stored data. |
| Recipients and processors | Your browser stores the choice; Cloudflare takes part in delivering the website. |
| Transfers outside the EU | The locally stored entry is not sent to any external provider. The website’s traffic passes through Cloudflare’s network. |
You can change or withdraw your choice at any time with the Cookie settings link in the footer.
3.4. Google Tag Manager before your choice
Google Tag Manager (GTM-N28MK78B) loads before you make a choice in the cookie banner. At that point it sets no cookies, but the request needed to load it sends your IP address to Google. Google Analytics 4 and Google Ads measurement only load after you accept.
| Aspect | Information |
|---|---|
| Data subjects | Visitors to the website. |
| Data processed | Data related to loading, in particular the IP address. |
| Purpose | Managing the consent choice and running the website. |
| Legal basis | Legitimate interest, GDPR Article 6(1)(f). |
| Retention | 60 days. |
| Recipients and processors | Google Ireland Limited. |
| Transfers outside the EU | Google LLC may also process data in the USA. See section 4. |
3.5. Cookies, analytics and conversion measurement
If you accept measurement, we use Google Analytics 4 (G-R5FVVNDFMV) and Google Ads conversion measurement. Your choice is passed on through Google Consent Mode v2. After you accept, the _ga and _ga_R5FVVNDFMV cookies may be stored in your browser for up to 2 years.
| Aspect | Information |
|---|---|
| Data subjects | Visitors who accept measurement. |
| Data processed | Visit and event data related to measurement, cookie identifiers. After you accept, sending the form may appear as a generate_lead event with the topic; the content of the form is not sent to measurement. |
| Purpose | Analysing how the website is used and measuring the effectiveness of our ads and conversions. |
| Legal basis | Consent, GDPR Article 6(1)(a) and section 155(4) of Hungarian Act C of 2003 on electronic communications. |
| Retention | The _ga and _ga_R5FVVNDFMV cookies for up to 2 years; Google Analytics data for 14 months. |
| Recipients and processors | Google Ireland Limited; Cloudflare also takes part in delivering the website’s traffic. |
| Transfers outside the EU | Google LLC may also process data in the USA; data may also reach the USA through Cloudflare’s network. The safeguards are described in section 4. |
You can withdraw your consent at any time with the Cookie settings link in the footer. This does not affect the lawfulness of processing before the withdrawal.
3.6. Fonts
We serve the website’s fonts from our own server, so loading the fonts sends no data to an external font provider.
| Aspect | Information |
|---|---|
| Data subjects | Visitors to the website. |
| Data processed | The server log data listed in section 3.2 related to requesting the font files. |
| Purpose | Displaying the website properly and running it securely. |
| Legal basis | Legitimate interest, GDPR Article 6(1)(f). |
| Retention | 30 days in the server log. |
| Recipients and processors | No external font provider. Cloudflare and our server providers are involved in the website’s traffic. |
| Transfers outside the EU | No separate external transfer because of the fonts; the website’s traffic passes through Cloudflare’s network. |
3.7. AI systems we run ourselves
We run AI systems of our own, built on open source, on our own servers. If, for example, we use them to summarise or categorise an incoming enquiry, the personal data in the enquiry is not sent to an external AI provider. The purpose, legal basis and retention are then the same as for the enquiry in section 3.1. Our server providers are listed in section 4, as is the information on Cloudflare’s traffic delivery. No automated decision-making within the meaning of GDPR Article 22 takes place.
3.8. Card payments and invoicing
This section only applies if you pay an offer by card. Card payment is being introduced. Payments are handled by Stripe; your card details never reach us. Invoicing is done through the számlázz.hu service.
| Aspect | Information |
|---|---|
| Data subjects | Customers paying by card and natural persons named on invoices. |
| Data processed | Customer, transaction and invoicing data needed for the payment and the invoice. Card details are handled by Stripe and never reach us. |
| Purpose | Processing card payments, performing the contract and meeting invoicing obligations. |
| Legal basis | Performance of a contract, GDPR Article 6(1)(b); compliance with accounting obligations, GDPR Article 6(1)(c). |
| Retention | Invoices are stored in the számlázz.hu cloud, for at least 8 years under accounting rules. |
| Recipients and processors | Stripe Payments Europe, Limited for payments (for fraud prevention and anti-money-laundering checks, Stripe acts as an independent controller); KBOSS.hu Kft. (számlázz.hu) for invoicing; our accountant (Farkas Győző, sole trader) for bookkeeping and tax returns. |
| Transfers outside the EU | Stripe also transfers data to Stripe, LLC in the USA; safeguards: primarily the EU-US Data Privacy Framework, secondarily standard contractual clauses. No transfer outside the EU for invoicing. |
3.9. Abuse reports
On the abuse page or at [email protected] you can report spam, phishing, malware, attacks or illegal content on a system we run.
| Aspect | Information |
|---|---|
| Data subjects | People who submit a report, and people the report contains data about, for example someone whose IP address appears in a log excerpt. |
| Data processed | Name, email address, the type of report, the affected URLs or IP addresses, the explanation, the evidence provided (for example email headers or log excerpts) and the fact of the good faith statement. For email, the data you give us and the data of the correspondence. |
| Purpose | Investigating the report, taking the necessary action and telling the reporter our decision. |
| Legal basis | For reports of illegal content: compliance with a legal obligation, GDPR Article 6(1)(c), under Article 16 of the Digital Services Act (Regulation (EU) 2022/2065). For other reports, such as spam or attacks: legitimate interest, GDPR Article 6(1)(f), in protecting our systems and their users. |
| Retention | 1 year from closing the report. If the matter goes to an authority or a court, until the proceedings are finally closed. |
| Recipients and processors | Where needed for the action, the owner of the affected system may see the content of the report. We only share your name and email address with them if you agree. We pass data to authorities where the law requires it. Emails are delivered through Amazon Web Services. The [email protected] mailbox runs on a server we operate ourselves. Cloudflare may also take part in transmitting the traffic and delivering the emails. |
| Transfers outside the EU | Data may reach the USA through Cloudflare’s network. The safeguards are described in section 4. |
The form is protected from spam by a hidden field; this requires no additional personal data.
4. Providers and data transfers
| Provider | Address and task | Transfers outside the EU |
|---|---|---|
| Amazon Web Services EMEA SARL | 38 Avenue John F. Kennedy, L-1855 Luxembourg. Cloud services and email sending (Amazon SES). | Data stays in the chosen region unless a transfer is needed for the service or to comply with the law; for transfers outside the EU, standard contractual clauses. We use an EU region. Amazon Web Services, Inc. is covered by the EU-US Data Privacy Framework certification of Amazon.com, Inc. |
| Cloudflare, Inc. | 101 Townsend Street, San Francisco, CA 94107, USA. CDN, delivering the website’s traffic, taking part in email delivery. It may process IP addresses in doing so. | USA. Safeguards: the EU-US Data Privacy Framework and standard contractual clauses, under GDPR Articles 45 and 46. |
| Google Ireland Limited | Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager, Google Analytics 4, Google Ads, and Google Workspace office services such as email and documents. The [email protected] and [email protected] mailboxes, however, run on a server we operate ourselves. | Google LLC may also process data in the USA. The safeguard for transfers to the USA is the EU-US Data Privacy Framework. |
| Hetzner Online GmbH | Industriestraße 25, 91710 Gunzenhausen, Germany. Rented dedicated and cloud servers; we operate the servers ourselves. | None: at its EU locations (Germany, Finland) data is processed only within the EU. |
| DigitalOcean, LLC | 105 Edgeview Drive, Ste. 425, Broomfield, CO 80021, USA. Cloud servers; we operate the servers ourselves. | We store data in an EU region; as the provider is based in the USA, it may also be accessed from there. Safeguards: the EU-US Data Privacy Framework, with standard contractual clauses as a fallback. |
| Google Cloud EMEA Limited | 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Cloud services. | Data may be processed at any facility of Google or its subprocessors; for transfers to the USA the safeguard is the EU-US Data Privacy Framework (Google LLC), for other countries standard contractual clauses. |
| Stripe Payments Europe, Limited | The One Building, 1 Lower Grand Canal Street, Dublin 2, Ireland. Card payments, only for card payments, once introduced. | USA (Stripe, LLC). Safeguards: primarily the EU-US Data Privacy Framework, secondarily standard contractual clauses. |
| KBOSS.hu Kft. (számlázz.hu) | Záhony utca 7/D, 1031 Budapest, Hungary. Invoicing. | None. |
| Farkas Győző, sole trader (pecsikonyvelo.hu) | Kőrösi Csoma Sándor utca 5., 7633 Pécs, Hungary; registration number: 57347158; tax number: 59327479-1-22. Bookkeeping and tax returns: data on invoices and accounting records. | None (Hungarian provider). |
5. Data security and personal data breaches
The website uses HTTPS. We limit access to personal data to the people who need it for their work, keep our systems regularly updated, make backups and log operations.
If a security incident affects personal data, we investigate its circumstances and possible effects, take the necessary measures, and notify the supervisory authority and the data subjects where required.
6. Your rights
To exercise your rights, write to [email protected]. Before fulfilling a request we may ask for information needed to confirm your identity, so that no one else’s data reaches an unauthorised person. We reply as soon as possible, within the 25-day deadline of the Infotv. and the one-month deadline of the GDPR.
6.1. Information and access
You can ask whether we process your personal data. If we do, you can access your data and information on the processing, in particular the purposes, the categories of data, the recipients, the retention period and the source of the data if we did not get it from you.
6.2. Rectification and completion
You can ask us to correct inaccurate data and complete incomplete data.
6.3. Restriction of processing
You can ask us to restrict processing, for example while we check the accuracy of data you dispute; if the processing is unlawful but you ask for restriction instead of erasure; if we no longer need the data but you need it for a legal claim; or while we assess your objection.
6.4. Withdrawing consent and objecting
You can withdraw your consent to cookies and measurement at any time with the Cookie settings link in the footer. Withdrawal does not make earlier processing based on consent unlawful.
Under GDPR Article 21 you can object to processing based on legitimate interest. We then assess your request and act according to the applicable rules.
6.5. Erasure
You can ask us to erase your personal data, for example if it is no longer needed for the original purpose, if you withdrew your consent and there is no other legal basis, or if you object to the processing on valid grounds. If we must keep the data because of a legal obligation or a legal claim, we take this into account when deciding on the request.
6.6. Data portability
If the processing is based on consent or a contract and carried out by automated means, you can ask to receive the data you provided to us in a structured, commonly used, machine-readable format, or, where the conditions are met, to have it transmitted to another controller.
7. Remedies
If you have a complaint about how we process your data, you can first contact us directly at [email protected]. You can also lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):
| Contact | Details |
|---|---|
| Address | Falk Miksa utca 9-11., 1055 Budapest, Hungary |
| Postal address | 1363 Budapest, Pf. 9. |
| Phone | +36 1 391 1400 |
| [email protected] | |
| Website | naih.hu |
You can also turn to another EU supervisory authority, or go to court; you may choose to bring the case before the regional court of your place of residence or stay.
8. Changes to this notice
We review and update this notice when needed. The current version is always published on the website, with its effective date.
9. Summary of processing
| Processing | Data subjects and data | Purpose and legal basis | Retention | Recipients and third countries |
|---|---|---|---|---|
| Contact | People contacting us; form and correspondence data. | Answering, offers, preparing a contract; GDPR Article 6(1)(f) or (b). | Up to 1 year from the last contact; if a contract is concluded, according to the related rules. | Amazon Web Services, our own server, Cloudflare; possible transfer to the USA through Cloudflare. |
| Server logs | Visitors; IP address and the log data listed in section 3.2. | Security and troubleshooting; GDPR Article 6(1)(f). | 30 days. | Server and cloud providers, Cloudflare; possible transfer to the USA. |
| Cookie choice | Visitors; the local upt-consent entry. |
Remembering the choice; GDPR Article 6(1)(f). | Does not expire, until you change or clear it. | Stored locally in the browser; Cloudflare in the website’s traffic. |
| Google Tag Manager before your choice | Visitors; in particular the IP address. | Managing consent and running the website; GDPR Article 6(1)(f). | 60 days. | Google Ireland Limited; possible processing in the USA. |
| Cookies and measurement | Consenting visitors; cookie identifiers, visit and event data. | Analytics and conversion measurement; GDPR Article 6(1)(a), Act C of 2003, section 155(4). | The listed cookies up to 2 years, GA data 14 months. | Google Ireland Limited, Cloudflare; possible transfer to the USA. |
| Fonts | Visitors; log data of the request. | Display and operation; GDPR Article 6(1)(f). | Log data: 30 days. | No external font provider; Cloudflare in the traffic. |
| AI systems we run ourselves | Data subjects of the underlying matter, for example enquiry data. | For example summarising, categorising; the legal basis of the underlying processing. | As for the underlying processing. | Our own servers; no external AI provider. |
| Card payments and invoicing, only for card payments | Paying customers and people named on invoices; payment, transaction and invoicing data. | Payment and invoicing; GDPR Article 6(1)(b) and (c). | At least 8 years (accounting rules). | Stripe, KBOSS.hu Kft., our accountant; transfer details in sections 3.8 and 4. |
| Abuse reports | Reporters and people named in reports; report data and evidence. | Investigation and action; GDPR Article 6(1)(c) (DSA Article 16) or (f). | 1 year from closing; if proceedings follow, until they are finally closed. | Owner of the affected system (reporter details only with consent), authorities, Amazon Web Services, own server, Cloudflare; possible transfer to the USA through Cloudflare. |