Privacy Policy
Tile 01 / GDPRThis Privacy Policy explains how CrystalQueryNest ("we", "us") collects, uses, and protects personal data when you visit our website, send us a project brief, or otherwise work with us. It applies in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR).
1.1 — Data We Collect
Brief data: the name, work email, company, phone number, budget range, service interest, and project description you type into the contact form. Correspondence data: the contents of emails, call notes, and attachments you send to [email protected]. Technical data: anonymized IP address, browser type, and pages viewed, collected only if you consent to analytics cookies as described in our Cookie Policy. Contract data: billing details, invoices, and payment status for clients who engage our services.
1.2 — Purposes & Legal Bases
We process brief and correspondence data to answer your enquiry and prepare a proposal (Art. 6(1)(b) GDPR — steps prior to a contract) or, where you have asked us to, to perform a signed statement of work (Art. 6(1)(b)). We process contract and billing data to deliver services and meet Hungarian tax and accounting obligations (Art. 6(1)(c)). We use technical data for security, abuse prevention, and — only with your consent — website improvement (Art. 6(1)(a) and Art. 6(1)(f), our legitimate interest in a secure, usable site). We never use your data for automated decision-making or profiling, and we never sell personal data.
1.3 — Processors & International Transfers
We share data only with processors who help us run the business: our EU-hosted email and infrastructure providers, our payment provider Stripe (for invoices you choose to pay online), and — where a project requires it — the cloud vendors named in your statement of work. Each processor acts under a written data-processing agreement. Should a processor outside the European Economic Area be involved, transfers are safeguarded by the European Commission's Standard Contractual Clauses.
1.4 — Retention
Project briefs and pre-contract correspondence are kept for 24 months after our last exchange, then deleted. Client contracts, invoices, and accounting records are retained for 8 years as required by Hungarian tax law. Newsletter or marketing consents (if given) last until you withdraw them. When a retention period ends, data is irreversibly deleted or anonymized.
1.5 — Your Rights
You have the right to access, rectify, erase, restrict, and port your personal data; to object to processing based on legitimate interests; and to withdraw consent at any time without affecting prior lawful processing. To exercise any right, email [email protected] — we respond within one month. You may also lodge a complaint with the Hungarian supervisory authority, NAIH (Nemzeti Adatvédelmi és Információszabadság Hatóság), naih.hu.