Legal
Privacy notice
How we process personal data on this website, for enquiries, contracts, security assessments and the client platform, under Articles 13–14 of Regulation (EU) 2016/679 (GDPR) and Hungarian Act CXII of 2011 (Infotv.).
Version: 2.0 · Effective: 12 November 2026
This English text is provided for convenience. In case of any discrepancy, the Hungarian version prevails.
1. Controller
1.1 Controller: Czeczó Krisztián Ádám egyéni vállalkozó (sole proprietor, trading as Bastinet). E-mail: info@bastinet.hu. Further statutory details are in the Legal notice.
1.2 The controller is not required to designate a data protection officer under Article 37 GDPR and has not done so. Data protection queries can be sent to the address above.
2. Principles
2.1 We process personal data lawfully, fairly and transparently, only for specified purposes, to the extent and for the time necessary, and ensure its accuracy and security (Article 5 GDPR). We keep records of processing activities (Article 30 GDPR).
3. Data, purposes, legal bases and retention
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Enquiries (form, e-mail) | Name, organisation, e-mail address, phone number (optional), topic, message | Responding to the enquiry, preparing a proposal | Pre-contractual steps: GDPR Art. 6(1)(b); for representatives of an organisation, legitimate interest: Art. 6(1)(f) | 1 year after the enquiry is closed; if a contract is concluded, as long as the contract data |
| Abuse prevention (form) | A keyed one-way hash of the IP address and the time of submission | Limiting bulk automated submissions | Legitimate interest: Art. 6(1)(f) | Up to 24 hours |
| Serving the website (server logs) | IP address, time, requested page, browser identifier, status code | Secure operation of the website, detecting errors and attacks | Legitimate interest: Art. 6(1)(f) | According to the hosting provider's logging practice, as long as needed for security |
| Contract and communication | Name, position, e-mail and phone of the Client's representatives and contacts | Concluding and performing the contract, communication | Performance of contract: Art. 6(1)(b); for the Client's staff, legitimate interest: Art. 6(1)(f) | 5 years after termination of the contract (Civil Code, Section 6:22) |
| Invoicing and accounting | Data on invoices and accounting documents | Accounting and tax obligations | Legal obligation: Art. 6(1)(c); Hungarian Act C of 2000, Section 169 | 8 years |
| Client platform account and logs | Username or e-mail, password hash, two-factor authentication data, role, actions, time, IP address | Providing access, security, accountability | Performance of contract and legitimate interest: Art. 6(1)(b), (f) | Until the account is closed; security logs up to 1 year |
| Security reports (security.txt) | Name or alias, e-mail address, content of the report | Handling the reported vulnerability, communication | Legitimate interest: Art. 6(1)(f) | 1 year after the case is closed |
3.2 Processing based on legitimate interest serves business communication with organisations, performance of contracts and protection of the website and our systems. The balancing test is available on request.
3.3 Contacting us is voluntary. Without the data needed to conclude and perform a contract the service cannot be provided. Data is usually obtained from the data subject; contact details of a Client's staff are provided by the Client (Article 14 GDPR), which is then the source of the data.
3.4 The website does not store data submitted through the contact form: it forwards the message by e-mail, and the message is kept only in the mailbox.
4. Data obtained during security assessments
4.1 During an assessment, personal data may become accessible in the tested systems. We do not process such data for our own purposes but as the Client's processor, on the Client's instructions and under a data processing agreement (Article 28 GDPR); the Client as controller is responsible for these processing activities.
- we record only the evidence needed to substantiate a finding and redact personal data in reports;
- assessment data is kept on encrypted storage and deleted within 90 days of delivery of the final report, unless agreed otherwise;
- we engage further processors only with the Client's prior written authorisation;
- we inform the Client without undue delay of any personal data breach affecting assessment data.
4.3 For development and hosting engagements, where the developed or operated system processes personal data, we likewise act as the Client's processor under the principles above and the data processing agreement.
5. Processors and recipients
5.1 Hosting, e-mail and server services: Rackhost Zrt., 6722 Szeged, Tisza Lajos körút 41., info@rackhost.hu. Data is stored in the European Union.
5.2 Accounting: our appointed accountant (details on request), only for data needed to meet accounting obligations.
5.3 Data is disclosed to authorities (for example the Hungarian tax authority, courts or investigating authorities) where required by law, to the extent specified.
5.4 AI-based services: data of website visitors and enquiries is not shared with AI providers. During an assessment, cloud AI services are used only with the Client's prior written authorisation, with data minimised and where possible pseudonymised, and only via providers that do not use the data for model training; the provider used is disclosed to the Client.
5.5 Processors may process data only on the controller's instructions under a contract compliant with Article 28 GDPR.
6. Transfers outside the EEA
6.1 We do not transfer personal data outside the European Economic Area, except for AI services authorised by the Client, in which case an adequacy decision or standard contractual clauses (Articles 45–46 GDPR) ensure adequate protection. Vulnerability databases (for example NVD, FIRST, MITRE, CISA) receive only public identifiers, never personal data.
7. Automated decision-making
7.1 We do not carry out automated decision-making, including profiling (Article 22 GDPR).
8. Cookies and similar technologies
8.1 This website uses no cookies, no analytics, advertising or social media tools, and loads no third-party content. Fonts are served from our own server. The contact form is protected without cookies, using a signed timestamp.
8.2 The client platform uses only cookies strictly necessary for login and secure operation, which do not require consent (Hungarian Act C of 2003, Section 155(4)).
9. Security
9.1 We apply technical and organisational measures appropriate to the risk (Article 32 GDPR), in particular:
- encrypted connections (TLS) and encrypted storage;
- invitation-only, role-based access and two-factor authentication;
- logging of access and actions;
- regular updates and backups;
- encrypted delivery of reports with the password sent through a separate channel.
10. Personal data breaches
10.1 Where a personal data breach is likely to result in a risk, we notify the Hungarian National Authority for Data Protection and Freedom of Information within 72 hours of becoming aware of it (Article 33 GDPR), and the data subjects where the risk is high (Article 34 GDPR). We keep a record of breaches.
11. Your rights
11.1 You may exercise the following rights against the controller:
- access to your data (Article 15 GDPR);
- rectification (Article 16);
- erasure (Article 17) where the purpose has ceased or there is no legal basis;
- restriction of processing (Article 18);
- data portability for automated processing based on contract (Article 20);
- objection to processing based on legitimate interest (Article 21).
11.3 Requests can be sent to info@bastinet.hu. We respond within one month, which may be extended by two further months where justified (Article 12 GDPR). Responses are free of charge; additional information may be requested for identification.
12. Remedies
12.1 You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9–11; postal address: 1363 Budapest, Pf. 9; phone: +36 1 391 1400; e-mail: ugyfelszolgalat@naih.hu; website: naih.hu.
12.2 You may also go to court; proceedings may be brought, at your choice, before the regional court of your place of residence or stay (Article 79 GDPR, Infotv. Sections 22–23). We recommend contacting us first so that we can resolve the matter quickly.
13. Changes to this notice
13.1 We update this notice when our processing or the law changes; the current version is always available on this page. Previous versions are available on request.