Privacy notice
This notice covers the personal data processed when you use zenty.hu — what we collect, why, on what legal basis, and for how long. In short: the waiting list asks for your email address and nothing else.
1. Who processes your data
The controller is the operator of the Zenty service. Its company identifiers — registered name, seat, company registration number and tax number — are on the Impresszum page.
For privacy matters, reach us at hello@zenty.hu. We are not required to appoint a data protection officer and have not appointed one — requests sent to that address are handled by us directly.
The partner law firm involved in company formation is an independent controller for the processing tied to its legal practice, under its own notice. This notice covers the zenty.hu website.
2. What we process, why and for how long
Zenty has not launched yet, so the service itself is not available. The website processes the following:
- Data
- Email address, sign-up language, the page you signed up from
- Legal basis
- Consent — GDPR Art. 6(1)(a). Signing up is voluntary and you can withdraw at any time; withdrawal does not affect processing carried out before it.
- Retention
- Until the launch notification is sent, and at most 24 months from sign-up — or until you unsubscribe, whichever comes first.
- Data
- The company name to check, email address, language, the page you submitted from
- Legal basis
- Steps taken at your request — GDPR Art. 6(1)(b), or consent where you are not preparing to enter a contract.
- Retention
- 12 months from the date we reply.
- Data
- A non-reversible fingerprint derived from your IP address and browser identifier (HMAC-SHA256). We do not store or log the raw IP address.
- Legal basis
- Legitimate interests — GDPR Art. 6(1)(f): protecting the service and third-party recipients from abuse.
- Retention
- 12 months.
- Data
- We do not store what you type. For these searches we record only the fingerprint above and the time of the query.
- Legal basis
- Legitimate interests — GDPR Art. 6(1)(f).
- Retention
- 12 months.
- Data
- Cookieless, aggregated traffic data: page viewed, referring source, language, device type. We set no identifying cookies on the marketing site and record no session replays.
- Legal basis
- Legitimate interests — GDPR Art. 6(1)(f).
- Retention
- Up to 12 months, in aggregate.
Providing your data is voluntary. If you do not give us your email address we cannot tell you when we launch — there is no other consequence. We carry out no automated decision-making and no profiling.
We do not ask for or process special categories of data (GDPR Art. 9). The site is not directed at people under 16; if we learn we have received such data, we delete it.
3. Who we share it with
We do not sell your data and do not pass it to third parties for marketing. We rely on the following processors, each under a data processing agreement:
- Vercel Inc. (USA) — hosting and serving the website.
- Supabase, Inc. — database. Storage is in an EU region (Ireland).
- Resend (Plus Five Five, Inc., USA) — sending confirmation and notification emails.
- PostHog, Inc. — web analytics, in its EU cloud (eu.i.posthog.com).
Beyond that, we disclose data only where the law requires it, or where an authority or court lawfully requests it.
4. Transfers outside the EU
The database and the analytics run in an EU region. Some of the providers above are established in the United States, so certain operations may involve a transfer outside the EEA. For those we rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, on the EU–U.S. Data Privacy Framework as the appropriate safeguard.
6. Your rights
Under the GDPR you have the following rights over data we hold about you:
- Access — ask whether we process data about you and request a copy.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your data, for example after withdrawing consent.
- Restriction — ask us to store the data but stop using it.
- Portability — receive data processed on the basis of consent in a machine-readable format.
- Objection — object to processing based on legitimate interests.
- Withdrawal of consent — at any time, without giving reasons, with effect for the future.
Exercise any of these by writing to hello@zenty.hu. You can leave the waiting list using the unsubscribe link in the confirmation email or by writing to the same address. We respond within 30 days at the latest; for complex requests that period can be extended by two months, and we will tell you in time if it is. Handling your request is free of charge.
7. Complaints and remedies
If you believe our processing is unlawful, write to us first — most matters are settled in one exchange. You may also complain to the supervisory authority:
- Hungarian National Authority for Data Protection and Freedom of Information (NAIH) — 1055 Budapest, Falk Miksa u. 9-11. · postal: 1363 Budapest, Pf. 9. · naih.hu
You may also go to court. Proceedings can be brought, at your choice, before the tribunal for your place of residence or your place of stay.
8. Security
Data reaches us over an encrypted connection (HTTPS) and is stored encrypted. Only server-side code can reach the database, behind row-level access control; the part of the site running in your browser never reads submitted data back. Access is kept to the minimum needed.
9. Changes to this notice
We update this notice when the scope of processing changes — for example when Zenty actually launches and the company-formation flow starts processing data. The revised text is published on this page with its effective date. We email people on the waiting list about material changes.