Privacy.

I use personal data only to reply to you, to prepare and fulfil an offer if we work together, to meet my accounting duties and to keep the site secure. I don’t sell it, share it for advertising or build profiles of visitors.

Zoltán Farkas, sole trader (Farkas Zoltán e.v., tax number 90541238-1-29), Berettyóújfalu, Hungary, is the controller for the personal data this site handles: I decide why and how it is used. For anything about your data, write to hello@wzee.dev.

The GDPR doesn’t require a data protection officer for a site like this (Article 37), so your questions and requests come straight to me.

I collect only what each purpose needs, use it only for that purpose, keep it accurate, keep it no longer than necessary and protect it with suitable technical and organisational measures.

The rules I follow are the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR), Hungary’s Act CXII of 2011 on informational self-determination (Infotv.), the Civil Code (Act V of 2013) and, for invoices, the Accounting Act (Act C of 2000).

Nothing, unless you write to me. There are no analytics, ads or tracking pixels, and the fonts are served from this site, not from Google. The only third-party code is Cloudflare’s bot check on the contact page, described below.

When you send the form, your name, email address and message, and the topics and budget you picked, are emailed to me through an email delivery service, described under “Who else handles the data”. The site itself keeps no copy. The same goes for emails you write to me directly.

I use them only to reply, to understand what you need and, if you ask, to prepare an offer. The legal basis is your request, as a step before a possible contract (Article 6(1)(b) GDPR), and my legitimate interest in answering the messages I receive (Article 6(1)(f)).

Your name, email address and message are needed to send the form; topics and budget are optional. Without the required fields I can’t reply. Please don’t include health data, copies of documents or other sensitive details the request doesn’t need.

I keep the conversation for as long as it is useful and delete it within two years of our last message. If we sign a contract, it becomes part of the project records below.

The contact page uses Cloudflare Turnstile to tell people from bots. When the page opens, it runs a short check in your browser and sends Cloudflare technical signals: your IP address, browser and device details (such as the User-Agent and TLS fingerprint) and which site is asking. It is usually invisible; now and then it asks you to tick a box. It sets no advertising or tracking cookies.

The legal basis is my legitimate interest in keeping spam and automated abuse out of my inbox (Article 6(1)(f) GDPR). Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, United States) processes the signals on my behalf to run the check, and as a controller in its own right to improve its bot detection, as its Turnstile privacy addendum explains (cloudflare.com/turnstile-privacy-policy). You can object; if you’d rather not run the check, email me at hello@wzee.dev instead.

If we work together, I use your name and contact details, your company’s details, the offer, the contract, project correspondence and payment details to deliver the work, stay in touch about it and handle any warranty or follow-up questions. The legal basis is our contract (Article 6(1)(b) GDPR).

Invoices and the data on them (billing name and address, tax number, what was delivered and for how much) are kept for 8 years, as section 169(2) of the Accounting Act requires (Article 6(1)(c)). Other project records are kept for 5 years after the work ends, the general limitation period for civil claims, or until any dispute is closed.

Invoicing data is shared with my accountant and invoicing service, and with the tax authority where the law requires it.

Like any website, the server that delivers a page receives each request: your IP address, the time, the page, the response and your browser. I don’t keep logs of these requests myself and see them only live, while I’m fixing a problem; I never use them to identify or profile you. The hosting provider, Cloudflare, handles them to deliver the site and keep it secure and working (my legitimate interest, Article 6(1)(f)), and keeps its own records under its privacy policy (cloudflare.com/privacypolicy). Records tied to a security incident may be kept until it has been investigated.

You can object to this use; I’ll look at your circumstances and stop unless there is a compelling reason to continue.

The site sets one cookie, “locale”, and only when you switch language, so it opens in that language next time. It lasts a year.

Your colour theme is kept in your browser’s local storage. Session storage, which is cleared when you close the tab, holds a note that the intro animation has played and, for a moment during a language switch, where you were on the page, so the new language opens at the same place.

None of these is sent anywhere or used to track you, and since they only do what you ask of the site, there is no cookie banner. You can view or delete them at any time in your browser’s settings, usually under privacy or site data; the site still works without them.

The site is hosted by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States, which serves it from its global network. For the content and request data that pass through it, Cloudflare acts as my processor (see its privacy policy, cloudflare.com/privacypolicy), may use its own sub-processors, and uses the data only to run the site.

Messages from the form are sent by email through Resend, a delivery service run by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, United States. Resend processes them on my behalf under its data processing addendum (resend.com/legal/dpa), which relies on the EU standard contractual clauses and the EU–US Data Privacy Framework, and may keep records of the message and its delivery on servers in the United States under its own retention rules. If you ask me to erase your message, I’ll also ask Resend to delete its records.

Resend delivers the message to my Gmail account, a free Google service, where it is kept. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) provides it under its own terms and privacy policy (policies.google.com/privacy), not under a processing agreement with me, and may store email on servers outside the EU. Messages are deleted from the Gmail account at the end of the retention periods above.

Cloudflare also runs the bot check on the contact page, as described above. I don’t sell or share your data with anyone else. An authority or court gets it only where the law requires it or on a lawful request.

If a provider processes data outside the European Economic Area, for example in the United States, it does so only with the safeguards Chapter V of the GDPR requires: an adequacy decision, such as the EU–US Data Privacy Framework, or the European Commission’s standard contractual clauses with additional measures where needed.

I make no decisions about you by automated means alone, and I don’t profile visitors.

The site is served only over encrypted HTTPS, access to accounts holding your data is limited to me and protected by strong authentication, software is kept up to date, the form is protected against automated abuse, and data is deleted when its retention period ends.

No transfer over the internet is completely secure, but I take every reasonable step to prevent unauthorised access, loss or disclosure. If a data breach happens, I document it, limit the harm, report it to the authority within 72 hours where the GDPR requires it, and tell you if it puts you at high risk.

The apps on the wzee.dev subdomains run in your browser. Files you open in them stay on your device and are never uploaded.

Where the conditions apply, you can ask what data I hold about you and get a copy, have it corrected or completed, have it deleted, restrict how it is used, receive it in a portable format, and object to uses based on my legitimate interest. Where something rests on your consent, you can withdraw it at any time; this doesn’t affect what happened before.

Write to hello@wzee.dev. I’ll answer without undue delay and within a month; for complex or numerous requests this can be extended by two more months, and I’ll tell you why within the first month. Requests are free, unless they are clearly unfounded or excessive. If I can’t be sure who is asking, I may ask only for what I need to confirm it.

If you think your data is mishandled, please tell me first, so I can look into it and put it right quickly.

You can also complain to the supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11; postal address 1363 Budapest, Pf. 9; phone +36 1 391 1400; ugyfelszolgalat@naih.hu; naih.hu.

You can also go to court, before the regional court (törvényszék) where you live if you prefer. You don’t have to complain to the authority first.

This notice changes when the law, the services I use or the way the site works change. The current version is always published here with the date it was last updated; if a change affects you significantly and I have your contact details, I’ll tell you about it.