Privacy notice

Version 1.0 · effective 14 August 2026

This notice explains what personal data Cordia Bt. handles, why, for how long, and who else is involved. It is written to Article 13 and Article 14 of Regulation (EU) 2016/679, the General Data Protection Regulation.

1. Who is responsible

In short: Cordia Bt. decides what happens to your data. One email address covers every question and every request.

Cordia Bt., registered in Hungary at 1147 Budapest, Kerékgyártó u. 56. a. ép. 1. em. 1., Hungary, company registration number 01-06-311772, is the controller within the meaning of Article 4(7) of the General Data Protection Regulation. Contact: info@cordiabt.hu, +36 30 691 1362. We have not appointed a data protection officer, as we are not required to under Article 37.

2. This website

In short: no cookies, no analytics, nothing loaded from anyone else. Two settings — your colour scheme and your language — stay in your browser and are never sent to us.

This website sets no cookies and operates no analytics, tracking, advertising or profiling. No fonts, scripts, images, or other resources are requested from any third-party server, which you can verify in your browser's network inspector.

Your browser stores two values locally:

• cordia-theme — whether you chose the light or the dark colour scheme.
• cordia-lang — which language you chose, so that your next visit opens in it.

Both are written only when you press the corresponding button. Neither is transmitted to us or to anyone else, neither identifies you, and both are removed when you clear your browser data.

These are preference settings you asked for by pressing a button, not tracking, which is why no consent banner appears. Nothing is stored on your device until you choose something.

The web server records a standard access log entry for each request, containing your IP address, your browser's user agent string, and the referring URL. These are used solely to operate and secure the site. They are retained for 30 days and then permanently deleted. Legal basis: Article 6(1)(f), our legitimate interest in running a secure and functioning website.

3. If you contact us

In short: we use your message to answer it. That is the whole purpose.

When you write or telephone, we process the contact details and the content you choose to supply, for the sole purpose of responding to you and, where relevant, assessing whether an engagement between us makes sense. Supplying this data is voluntary; without it we cannot reply. Legal basis: Article 6(1)(b), steps taken at your request prior to entering a contract, together with Article 6(1)(f), our legitimate interest in answering correspondence addressed to us.

We operate no mailing list, no newsletter, and no marketing automation. Your address is not added to any list and you will not receive follow-up messages you did not ask for.

4. Automated processing of correspondence

In short: software may sort and summarise your message, and may draft a reply. It never decides anything, and a person always reads and sends.

Incoming correspondence may be sorted, summarised, and prepared for reply using artificial intelligence systems. These run either on infrastructure we operate ourselves, or on the inference services listed in section 6, each configured so that the provider retains no content after the request is served and uses no content to train any model.

No automated decision-making or profiling within the meaning of Article 22 takes place. No system decides whether to reply to you, what to offer you, or whether to work with you. Every decision and every message sent to you is made and approved by a person.

Where an artificial intelligence system has been used to draft any part of a reply you receive, that fact is stated in the reply.

5. How long we keep it

In short: five years, or sooner if you ask. Invoices are the one exception, because the law fixes those.

Correspondence is retained for up to five years from the last exchange, or until you ask us to erase it, whichever comes first. To have it erased, write to info@cordiabt.hu from the address you contacted us from and say so. No form, no account, and no reason is required.

Where our exchange leads to an engagement, accounting documents relating to it are retained for the period required by Hungarian accounting legislation. That retention is a legal obligation under Article 6(1)(c) and we cannot shorten it at your request. It applies only to the accounting records themselves, not to the rest of the correspondence.

6. Who else is involved

In short: the company that hosts the website, the company that hosts our email, and the AI services named below. Nobody else, ever, unless a law compels it.

How these relationships are governed:

• Email runs on our own Microsoft 365 organisational tenant, under Microsoft's published data protection terms.
• Each AI service is engaged under the data processing terms it publishes for business use, configured so that no content is retained once the request is served and no content is used to train any model.
• Where a provider offers processing inside the EU, we use it.
• Where a request is served in the United States, the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework under Article 45 where the provider is certified under it, and otherwise on standard contractual clauses under Article 46.
• We verify each provider's certification ourselves on the US Department of Commerce Data Privacy Framework list. Checked on 14 August 2026: Microsoft Corporation, Google LLC and Amazon.com, Inc. were each listed as Active under the EU-US Data Privacy Framework. You can repeat the check at that link.
• Each provider publishes its own current certifications and audit reports, which you can inspect without going through us: Microsoft Service Trust Portal, Google Cloud compliance offerings, and the AWS Trust Center.
• We send only the content needed to produce the summary we asked for. Nothing is sent for any other purpose, and no service has standing access to our mailbox.
• Your data is not sold, is not shared for advertising, and is not disclosed to any other party except where a legal obligation compels it.

7. Your rights

In short: see it, correct it, delete it, restrict it, take it elsewhere, or object. One email is enough, and we answer within a month.

The rights below are yours under the General Data Protection Regulation. To use any of them, write to info@cordiabt.hu.

• Article 15 — right of access: a copy of the personal data we hold about you.
• Article 16 — right to rectification: correction of anything inaccurate or incomplete.
• Article 17 — right to erasure: deletion of your data, subject only to the accounting retention in section 5.
• Article 18 — right to restriction: we hold the data but stop processing it.
• Article 20 — right to portability: your data in a machine-readable form.
• Article 21 — right to object: to any processing we base on legitimate interest.
• Article 22 — not to be subject to solely automated decisions. We take none, as set out in section 4.

We respond within one month, extendable by two further months for complex requests, in which case we tell you why within the first month. Exercising these rights is free of charge.

If you believe we have handled your data unlawfully, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság), naih.hu, or with the supervisory authority of the EU member state where you live or work.

8. Changes to this notice

In short: every version is numbered and dated. The date at the top tells you which one you are reading.

This notice carries a version number and an effective date, shown at the top of the page. When it changes materially, the version number is raised, the effective date is updated, and the superseded version remains available so you can see what changed.