Privacy notice

Effective from 8 November 2026.

This notice explains how the operator of the cogma.hu website processes the personal data of visitors, enquirers and customers in accordance with the General Data Protection Regulation (GDPR, (EU) 2016/679) and Hungarian law (in particular the Infotv.).

1. The controller

Name: Tamás Molnár e.v. (sole proprietor; brand name: COGMA)
Registered office: 2120 Dunakeszi, Barátság útja 12. A ép. 3. em. 91. ajtó
Tax number: 92404777-1-33
Registration number: 62854746
E-mail: info@cogma.hu
Phone: +36 30 610 1751

Data protection requests (access, erasure, objection, etc.) are accepted at info@cogma.hu.

2. What data we process, why and for how long

2.1 Contacting us via the form or e-mail

Data: name, e-mail address, the text of your message, the package you are interested in, the state of the “coffee” checkbox and the language of the page; for e-mail enquiries, the data you provide.
Purpose: answering your enquiry, arranging a conversation, preparing a quote.
Legal basis: GDPR Article 6(1)(b) (steps taken at your request prior to entering into a contract); for other enquiries Article 6(1)(f) (legitimate interest in answering the enquiry).
Retention: until you request erasure. We review the data at least annually and delete what is no longer needed. If a contract is concluded, sections 2.5–2.6 also apply.
Recipients: the form message reaches us by e-mail (hosting provider: Rackhost Zrt.); the e-mail account uses Google's Gmail service.

2.2 Bot protection of the form (Cloudflare Turnstile)

Data: technical data (IP address, browser and device data, the result of the bot-protection check) processed by Cloudflare.
Purpose: protecting the form against automated abuse (spam).
Legal basis: GDPR Article 6(1)(f) (legitimate interest: security of the website and the form).
Recipient: Cloudflare, Inc. (USA); its own notice: cloudflare.com/privacypolicy. Transfers are covered in section 4.

2.3 Google Maps (only with your consent)

Data: when the map is loaded, your browser connects to Google's service (IP address, browser data, cookies).
Purpose: showing our registered office on a map.
Legal basis: GDPR Article 6(1)(a) (consent). The map only loads after you consent. You can withdraw consent at any time with the “Cookie settings” button in the footer; withdrawal does not affect the lawfulness of earlier processing.
Recipient: Google (Google Ireland Limited / Google LLC).

2.4 Booking a time and video calls (Google Calendar, Google Meet)

Data: if you click the “Let's video call – Book a time!” card, you are taken to a Google Calendar booking page (external site, opens in a new tab). The data you enter there: name, e-mail address, the booked time and any note; for video calls, the technical data of Google Meet.
Purpose: booking and holding the meeting.
Legal basis: GDPR Article 6(1)(b) (steps prior to entering into a contract) or Article 6(1)(f) (legitimate interest).
Retention: until you request erasure (see 2.1).
Recipient: Google; Google's own privacy notice also applies when you use the booking page.

2.5 Performing a contract and customer relations

Data: name, company name, e-mail address, phone number, address and billing details, communication about the project.
Purpose: delivering the service, keeping in touch.
Legal basis: GDPR Article 6(1)(b) (performance of a contract); Article 6(1)(f) for establishing or defending legal claims within the limitation period.
Retention: for the duration of the contract, then until the end of the general limitation period (5 years).

2.6 Invoicing and bookkeeping

Data: data on invoices (name, address, tax number, etc.).
Legal basis: GDPR Article 6(1)(c) (legal obligation: accounting and tax law).
Retention: for the statutory period applicable to accounting documents, typically 8 years.
Recipients: the provider of the invoicing software in use and the appointed accountant (their names are available on request).

2.7 Operating the website (server logs)

Data: when you open the site, technical logs may be created on the hosting provider's server (IP address, time, requested page, browser data).
Purpose: operational security, troubleshooting, preventing abuse.
Legal basis: GDPR Article 6(1)(f) (legitimate interest).
Processor: Rackhost Zrt., under its own rules (rackhost.hu/privacy-policy).
The website currently does not use any external analytics, advertising or social-media tracking service; the number of times a blog article is opened is measured by our own counter that does not store personal data (see section 2.9).

2.8 Remembering your cookie choice

Your cookie choice is stored in your browser's local storage (localStorage); we do not receive it. This is storage necessary for the site to work, used to remember your choice.

2.9 Blog article view counter

Data: the total number of times each blog article has been opened. We do not store personal data; to filter out repeated refreshes we keep a non-reversible check code (hash) derived from the visitor's IP address on the server for at most 30 minutes, after which it is deleted.
Purpose: the view count shown next to the article.
Legal basis: GDPR Article 6(1)(f) (legitimate interest: showing how widely the content is read).
Nothing is stored on your device for this (no cookie or localStorage).

2.10 Entrance of the interactive demos (bot filtering, acceptance of the terms)

Where: demo.cogma.hu, cogma.hu/crm-demo/, cogma.hu/etterem-demo/ – before entering, the terms of use must be accepted.
Data: time of acceptance, version and fingerprint of the terms, a non-reversible fingerprint of the IP address made with a secret key (the raw IP address is not stored), the browser identifier and language, the domain of the previous page; the number of requests sent to the demo (rate limit); time and type of suspicious events (for example a robot or too many requests). Bot filtering is done by Cloudflare (technical data: IP address, browser and device data, result of the check).
Purpose: protecting the demos against automated access and mass copying; proving that the visitor accepted the terms; enforcing legal claims where necessary.
Legal basis: GDPR Article 6(1)(f) (legitimate interest: protecting our intellectual property and systems; establishing, exercising and defending legal claims).
Retention: the acceptance and event logs for 12 months, the rate-limit counters for at most 2 days; in case of a dispute until it is closed.
Cookie: entry is remembered by a signed cookie (cogma_demokapu) valid for 24 hours and readable only on the demo's address; the visitor's own demo copy is identified by a further cookie. These are necessary for the demo to work.
Please do not enter real personal data into the demo; anything entered is deleted together with the visitor's copy after at most 24 hours.

2.11 YouTube videos (only with your consent)

Where: the short product videos (“In half a minute”) on the product pages and the Products page.
Data: until you start a video, you only see a preview image served from our own hosting, and no request is sent to YouTube. When you start a video, your browser connects to YouTube's privacy-enhanced player (youtube-nocookie.com): IP address, browser and device data, playback data; YouTube may also use cookies and similar storage.
Purpose: playing the product videos.
Legal basis: GDPR Article 6(1)(a) (consent): pressing the play button, or the “YouTube videos” category of the cookie banner. You can withdraw consent at any time with the “Cookie settings” button in the footer; the player is then removed from the page.
Recipient: Google (Google Ireland Limited / Google LLC); its own notice: policies.google.com/privacy.

3. Recipients and processors

Rackhost Zrt. (6722 Szeged, Tisza Lajos körút 41., Hungary): hosting and e-mail service.
Google (Google Ireland Limited / Google LLC): Gmail, Calendar, Meet, Maps, YouTube.
Cloudflare, Inc.: bot protection of the form and of the interactive demos.
The provider of the invoicing software and the appointed accountant.

We do not pass your data to any other third party unless the law requires us to.

4. Transfers outside the European Economic Area

Google and Cloudflare are US providers, so your data may also be transferred to the United States. Such transfers rely on appropriate safeguards applied by the providers (for example the EU–US Data Privacy Framework or standard contractual clauses); details are in the providers' own notices.

5. Your rights

access to the data we hold about you (GDPR Article 15);
rectification (Article 16);
erasure (Article 17);
restriction of processing (Article 18);
data portability (Article 20);
objection to processing based on legitimate interest (Article 21);
withdrawal of consent at any time (Article 7(3)).

You can submit your request at info@cogma.hu. We respond within one month (which may be extended by two further months where necessary, given the complexity of the request).

6. Legal remedies

If you believe the processing of your data infringes your rights, you may lodge a complaint with the supervisory authority:

Authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary (postal address: 1363 Budapest, Pf.: 9.)
Phone: +36 (1) 391-1400
E-mail: ugyfelszolgalat@naih.hu
Website: www.naih.hu

You may also take legal action; at your choice, the case can be brought before the regional court competent for your place of residence or stay.

7. Data security

We protect data with appropriate technical and organisational measures: the website is served over an encrypted (HTTPS) connection, the form is protected by bot protection, and the data is accessible to the controller.

8. Automated decision-making

We do not carry out automated decision-making or profiling.

9. Changes to this notice

We may update this notice from time to time; the current version is always available on this page. Last updated: 8 November 2026 (YouTube videos, section 2.11)