Last updated: 14 October 2026
This privacy policy explains how Cluedit Kft. handles personal data when you visit cluedit.io, send us a message, book a free health check or work with us. We keep it short where we can and specific where it matters.
We act as the data controller for the processing described here. We process personal data in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Hungarian law, in particular Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information.
Who we are
| Data controller | Cluedit Korlátolt Felelősségű Társaság (Cluedit Kft.) |
|---|---|
| Registered office | 1095 Budapest, Gát utca 21. fszt. 1., Hungary |
| Company registration number | 01-09-391558 (Company Registry Court of Budapest) |
| Tax number | 27476419-2-43 |
| info@cluedit.hu | |
| Phone | +36 20 598 4030 |
| Website | cluedit.io |
We have not appointed a data protection officer, because our processing does not require one. For any question about your data, write to info@cluedit.hu.
At a glance
| Why we process data | Which data | Legal basis | How long we keep it |
|---|---|---|---|
| Answering your message or health-check request | Name, work email, company, phone (optional), your answers and message, the page you sent it from | Steps before a contract at your request (Art. 6(1)(b)); for company representatives, our legitimate interest in answering business enquiries (Art. 6(1)(f)) | 1 year after our last exchange, unless a contract follows |
| Booking and holding the health check call | Name, email, the time you choose, our notes and the written summary | Art. 6(1)(b) and, for company representatives, Art. 6(1)(f) | 1 year after the call, unless a contract follows |
| Contracts and invoicing | Contact and billing details, signature, the data needed to perform the contract | Contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), legitimate interest for company representatives (Art. 6(1)(f)) | 5 years after the contract ends; invoices and accounting records 8 years |
| Protecting the website | IP address, browser data, the pages requested | Our legitimate interest in a secure website (Art. 6(1)(f)) | Server logs for a limited period (see below); the anti-spam check for 10 minutes |
| Analytics and the Clutch review widget | Cookie identifiers, pages visited, device and browser data | Your consent (Art. 6(1)(a)) | See the cookie policy |
| Enforcing or defending legal claims | Any of the data above that is relevant | Our legitimate interest (Art. 6(1)(f)) | Until the claim is settled or time-barred |
Messages and health-check requests
When you use a form on our website, we ask for your first and last name, work email and company. Your phone number, the two questions (what you need help with, and where you are today) and your message are optional.
The form also sends us, without you typing it, the page you sent it from, the page you first arrived on and any campaign tags in the link that brought you to us (for example utm_source=linkedin). We use these only to understand which pages and channels bring enquiries. They are not linked to analytics cookies.
Why: to read your request, reply to you, prepare the health check and, if you want, an offer. Where it goes: the form sends your details directly to our customer relationship management system (Salesforce), which also sends you an automatic confirmation email. If that connection fails, the request is sent to our own mailbox instead, so it isn’t lost. Our website does not keep a copy.
Spam protection: to stop automated abuse, the website briefly uses your IP address to limit how many messages one connection can send. It stores only a one-way, salted hash of it, never the address itself, and deletes it after 10 minutes. The form also contains a hidden field and a timing check that people never notice. In addition, the form uses Google reCAPTCHA, which our CRM requires to accept website enquiries: when you start filling in a form, your browser loads reCAPTCHA from Google, and Google receives technical data about your browser and how you use the page (for example your IP address and mouse movements) to tell people from bots, under Google’s privacy policy and terms. Nothing is loaded from Google before you use a form. Legal basis: our legitimate interest in keeping the form free of spam.
How long: if no contract follows, we delete the request one year after our last exchange with you. If a contract follows, the rules under “Contracts and invoicing” apply.
The free health check
After a health-check request, the confirmation shown in place of the form offers a link to our Google Calendar booking page, where you can pick a time. The booking page is run by Google: when you use it, Google processes the name, email and time you enter, under Google’s privacy policy. Our website does not embed it or load anything from Google until you click the link.
The call itself takes place online. We don’t record it. We take notes during the call and may send you a short written summary afterwards. We keep both under the same rules as your request.
Business contacts, contracts and invoicing
When we prepare or perform a contract with your company, we process the contact details of the people we work with, the billing details and the data needed to deliver the work.
- Legal basis: the contract, where you are a party yourself (Art. 6(1)(b)); our and your company’s legitimate interest in cooperating, where you act on its behalf (Art. 6(1)(f)); and our legal obligations for invoices and accounting records (Art. 6(1)(c)).
- How long: five years after the contract ends, which is the general limitation period under the Hungarian Civil Code; invoices and the accounting records that support them for eight years, as Section 169 of Act C of 2000 on Accounting requires.
When we work in your Salesforce or other systems, we may see personal data that your company controls. In that case your company is the controller, and we act as its processor under the terms of our contract.
Visiting the website
Like every website, ours receives technical data when you visit: your IP address, the date and time, the page requested, the referring page and your browser type. Our hosting provider records these in server logs to keep the site secure and working. The logs are kept only as long as security requires and then deleted.
Cookies and similar technologies: the site sets only one cookie of its own without asking: the one that remembers your cookie choice. Google Analytics, through Google Tag Manager, and the Clutch review widget load only after you agree. Until then, nothing is requested from Google or Clutch, except Google reCAPTCHA once you start filling in a contact form (see “Spam protection” above). The details, and how to change your choice, are in our cookie policy.
Links: links to LinkedIn, Clutch, Crunchbase and other sites are plain links. Those sites process data under their own policies once you open them.
Who receives your data
We don’t sell personal data. Inside Cluedit, only the people who need it see it: our management, and the consultants working on your request or project. We use these service providers, who process data on our behalf under written agreements:
| Provider | What for | Privacy information |
|---|---|---|
| Salesforce, Inc. (415 Mission Street, 3rd Floor, San Francisco, CA 94105, USA) | Our CRM: website enquiries, business contacts, automatic confirmation emails | salesforce.com/company/privacy |
| Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) | Email (Google Workspace), the booking page (Google Calendar), spam protection on the contact form (reCAPTCHA), and, after your consent, Google Analytics and Google Tag Manager | business.safety.google/privacy |
| RackForest Zrt. (1132 Budapest, Victor Hugo utca 11. 5. em. B05001, Hungary; info@rackforest.hu) | Website hosting and server logs, in data centres in Budapest | rackforest.com |
The Clutch review widget is provided by Clutch (clutch.co). If you accept marketing cookies, Clutch receives data from your browser as a separate controller, under Clutch’s privacy policy.
We may also have to disclose data to courts or authorities when the law requires it.
Transfers outside the European Economic Area
Some of these providers, or their sub-processors, are based in the United States. Where data leaves the European Economic Area, the transfer relies on the EU–US Data Privacy Framework for providers certified under it (you can check the certified list), or on the European Commission’s standard contractual clauses.
How we protect your data
We keep personal data in access-controlled systems, use encrypted connections, and give access only to the people who need it. Our website forms send data over an encrypted connection and the website itself stores no copy of your messages.
Your rights
You can ask us at any time, free of charge:
- for access: whether we process your data, and a copy of it;
- for rectification of inaccurate or incomplete data;
- for erasure, where we have no legal reason to keep the data;
- for restriction of processing, for example while we check a complaint;
- for portability: the data you gave us, in a machine-readable format, where processing is based on consent or a contract;
- to object to processing based on our legitimate interest, on grounds relating to your situation;
- to withdraw your consent to cookies at any time, using the “Cookie settings” link at the bottom of every page. This doesn’t affect processing before the withdrawal.
Write to info@cluedit.hu. We reply within one month. For complex requests we may extend this by up to two further months, and we’ll tell you why within the first month. We may ask you to confirm your identity before we act.
Complaints: if you think we handle your data unlawfully, you can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH: 1055 Budapest, Falk Miksa utca 9–11; postal address 1363 Budapest, Pf. 9.; phone +36 1 391 1400; ugyfelszolgalat@naih.hu; naih.hu) or with the authority in the EU country where you live or work. You can also go to court; in Hungary you can choose the regional court (törvényszék) of your place of residence. We’d appreciate the chance to sort it out with you first.
Do you have to give us your data?
No. Giving us your details is voluntary, but we can’t reply without a name, an email address and your company. We don’t make decisions about you by automated means, and we don’t profile visitors. Our services are for businesses and are not directed at children.
Changes to this policy
We update this policy when our processing changes, for example when we add a new service provider. The date at the top shows the latest version. If a change affects you significantly, we’ll tell you before it takes effect.