Privacy Policy
The Hungarian text governs. This is a translation for convenience.
1. Who we are
| Name | Kántor Attila egyéni vállalkozó |
| Registered seat | 7940 Szentlőrinc |
| Registry number | 59856054 |
| Tax number | 90593761-1-22 |
| kantor.attila@carbonhost.hu | |
| Phone | +36 70 416 8003 |
| Where the platform is hosted | RendszerNET Kft., 7030 Paks, Kölesdi út 44. |
We have not appointed a data protection officer; Article 37 GDPR does not require one of us. We answer privacy questions at the address above.
2. What we process, why, and on what basis
2.1 Account and billing
Registration requires: e-mail address, first and last name, billing country, postal code, city, street and house number. Registering as a company also requires the company name, VAT number and company registration number. A phone number is optional.
- Basis: performance of the contract (Art. 6(1)(b)); for billing and tax identifiers, a legal obligation (Art. 6(1)(c)).
- Retention: until the contract ends; for data appearing on accounting documents, 8 years under the Hungarian Accounting Act (2000. évi C. tv. § 169).
The same identity is also held by Keycloak, the system that handles sign-in, as a separate user record. An erasure request is carried out in both.
2.2 Sign-in and passwords
The platform does not store your password; only Keycloak handles it. Password-reset and e-mail-verification links are held only as irreversible SHA-256 digests and expire after 30 minutes and 24 hours respectively.
2.3 Fraud prevention and automated decisions
Called out separately, because it can affect you.
Registration is automatically refused if the e-mail address belongs to a disposable or block-listed domain. Beyond that — where risk scoring is enabled — the system scores your IP address (country, type of network) and your e-mail domain. A high score sends the order to manual review.
- Basis: legitimate interest (Art. 6(1)(f)) — preventing fraud and abuse.
- Your right: under Article 22 GDPR you may ask for human review, express your point of view and contest the decision. Write to kantor.attila@carbonhost.hu.
- Retention: the computed risk score is stored against the account.
2.4 IP addresses and device data
- At checkout we record your IP address and keep it with the order.
- At sign-in and on security-relevant actions the event log records the IP address and the browser user agent.
- On a referral link click the IP address is stored as a digest. This is pseudonymous, not anonymous data: recovering the address from the digest is not theoretically excluded.
Basis: legitimate interest (Art. 6(1)(f)) — security and abuse prevention.
2.5 Support
We store ticket content, attachments and correspondence in order to answer you and to be able to look the matter up later. Basis: performance of the contract and legitimate interest.
2.6 Data arising from use
For hosting and virtual servers the system records resource-usage samples (storage, traffic, processor time) to enforce plan limits and to bill.
3. Data you store — here we are a processor
What you put into your hosting, database, mailbox or DNS zone is not processed for our own purposes. For that data you are the controller and we are the processor, acting only on your instructions and only as far as providing the service requires. The details are in the processor section of the Terms.
Two things must be said here as well:
Your visitors' IP addresses reach us too. The web server writes an access log containing the visitor's IP address, the requested URL, the response code and the number of bytes transferred. We process this for operations and security. If your website has its own privacy notice, this is worth stating in it.
Staff access. In normal operation we do not read the content you store. With administrator rights we can, however, access your database password — and through it your database — for troubleshooting or to investigate abuse. Every such access is written to an append-only event log.
4. Who we share data with
Only those who need it to provide the service.
| Recipient | What they receive | Why |
|---|---|---|
| KBOSS.hu Kft. (Számlázz.hu) | billing name, address, tax number, line items | issuing the invoice |
| Komoot GmbH (photon.komoot.io) | the street fragment typed, and the city | helping you fill in a billing address |
| Let's Encrypt | the domain name a certificate is requested for | issuing the HTTPS certificate |
| RendszerNET Kft., 7030 Paks, Kölesdi út 44. | running the servers | operating the platform |
We currently use no online payment provider and no SMS provider — payment is by bank transfer — so there is no such recipient. If that changes, this list is extended before the change goes live.
About the geocoder: the lookup is made by our own server, so your IP address does not reach the provider — only the street fragment and the city name.
About certificates: issuing an HTTPS certificate publishes your domain name to public, worldwide Certificate Transparency logs. Those logs cannot be erased, and the entry outlives the service.
Where processing takes place: Magyarország. We do not transfer data outside the EEA.
5. How long we keep it
| Data | Retention |
|---|---|
| Account data | until the contract ends |
| Data on accounting documents | 8 years (2000. évi C. tv. § 169) |
| Resource-usage samples | 48 hours in detail, aggregated thereafter |
| Data of a terminated service | 30 days from termination, then permanent deletion |
| A database marked for deletion | 30 days, restorable throughout |
6. Security
What we actually do:
- The connection between your browser and the platform is available over TLS only, with HSTS.
- Passwords and access tokens are stored only as irreversible digests. Database and console passwords are held in an AES-256-GCM envelope that the system decrypts only in order to display them.
- Two-factor authentication is mandatory for administrator access.
- Security-relevant actions are written to an append-only, hash-chained log.
- The servers run on a segregated private network.
What we do not claim: database contents are not encrypted at the disk level, and internal network traffic is not end-to-end encrypted. We would rather say so than promise the opposite.
7. Your rights
You may request access, rectification, erasure or restriction, object to processing based on legitimate interest, and request data portability.
Exercise these by writing to kantor.attila@carbonhost.hu. We answer within 30 days.
Plainly: the portal has no self-service account deletion and no data-export button today. These requests are handled by hand over e-mail. On erasure we close the sign-in account, but data on accounting documents must be kept to the end of the statutory retention period above.
8. Complaints
Write to us at kantor.attila@carbonhost.hu.
You may also complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9-11.; postal: 1363 Budapest, Pf. 9.; ugyfelszolgalat@naih.hu; www.naih.hu), or go to court.
9. Changes
We may amend this notice. We will tell you by e-mail to your registered address at least 15 days before a change takes effect.
In force from: 2026-09-06