1. Introduction and Scope

This Privacy Policy explains how we collect, store, use and protect personal data in the course of providing our data processing and workflow optimisation services, as well as during the use of our website. Our data processing activities comply with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR),
• Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Hungarian Infotv.),
• Regulation (EU) 2024/1689 (EU AI Act), and
• all other applicable EU and Hungarian data protection legislation.

This Policy applies to:

• Current and prospective clients
• Website visitors
• Individuals who submit contact, quiz or appointment booking forms
• Any data subject whose personal data we process in the course of our services

2. Data Controller

Controller: Baltai Bettina (sole trader) and Gyenge Dániel István (sole trader)
Registered address: Látóhegy utca 2/B, 8200 Veszprém, Hungary
Email: info@synalist.com
Website: www.synalist.com

3. Categories of Personal Data We Process

3.1. Data Processed in the Course of Service Delivery

Depending on the nature of the project, we may process the following data:

• Identification data (name, job title, business contact details)
• Business data provided by the client
• Data content required for processing
• Technical metadata for workflow automation

In line with the principle of data minimisation, we process only the data strictly necessary for each purpose.

3.2. Data Processed via the Website

• Technical / functional cookies
• Contact form: name, email address, message content

3.3. Data Collected via the Quiz Form (Fluent Forms)

Our website features an interactive quiz. Completion of the quiz requires the following data:

• Last name
• First name
• Email address
• Answers submitted to the quiz questions

Data is collected through the Fluent Forms WordPress plugin and stored in the website database on the hosting server. Based on the submitted data, an automated PHP snippet (WPCode) evaluates the answers and sends the result to the email address provided by the respondent.

3.4. Data Collected via the Appointment Booking System (Fluent Booking)

Our website allows users to book a consultation appointment through the Fluent Booking system. The following data is required:

• Full name (last name and first name)
• Email address
• Phone number
• Chosen date and time, and type of meeting (online / in-person)

If an online meeting is selected, a Microsoft Teams invitation will be sent to the email address provided by the data subject.

4. Purposes, Legal Bases and Retention Periods

5. Quiz Data Processing — Further Detail

5.1. How Data Is Collected and Processed

The quiz form is managed by the Fluent Forms WordPress plugin. Submitted data is stored in the WordPress database on the hosting server, which is located within the European Economic Area (EEA), under Hungarian jurisdiction.

Processing of submitted data and dispatch of the results email are carried out automatically by a WPCode PHP snippet. This automated processing is limited to evaluating the quiz and communicating the result; it does not produce any decision with a legal or similarly significant effect on the data subject.

5.2. Limitations on the Use of Quiz Data

• Data submitted via the quiz is used solely to evaluate the quiz and return the result to the respondent.
• Data is not shared with third parties and is not used for marketing purposes.
• The data subject may withdraw their consent at any time by sending a request to info@synalist.com, whereupon their data will be deleted without undue delay.

6. Appointment Booking — Further Detail

6.1. How Data Is Collected and Stored

Appointment bookings are managed by the Fluent Booking WordPress plugin. Data entered during the booking process is stored on the hosting server within the EEA.

6.2. Online Meetings — Microsoft Teams

If the data subject selects an online meeting, a Microsoft Teams invitation will be sent to the email address provided. For this purpose, the email address is shared with Microsoft’s Teams service. Microsoft’s processing is governed by the Microsoft Privacy Statement. Any transfer of personal data outside the EEA in connection with Teams is carried out on the basis of Standard Contractual Clauses (SCCs) approved by the European Commission, providing appropriate safeguards under GDPR Art. 46.

6.3. Limitations on the Use of Booking Data

• Booking data is used solely to register the appointment, send a confirmation and reminder, and — for online meetings — to deliver the Teams invitation.
• Data is not shared with any third party other than Microsoft (for Teams invitations) and is not used for marketing purposes.

7. Data Processing in the Course of Service Delivery

Depending on the nature of the project, we act either as a data controller or as a data processor. When acting as a data processor, we process personal data exclusively on the basis of the client’s documented instructions (GDPR Art. 28), in accordance with the client’s data protection policies.

8. Technical Cookies

We use only technically necessary cookies for the operation of our website:

• Server-side session management
• Security functions
• Basic website features (e.g. form functionality)

We do not use analytical or marketing cookies. Technically necessary cookies do not require prior consent, as they are essential for the proper functioning of the website (GDPR Art. 6(1)(f)).

9. Processors and Third Parties

We enter into data processing agreements with all processors in accordance with GDPR Art. 28.

10. Data Security Measures

• Access controls (data is accessible only to authorised persons)
• Encrypted data storage and HTTPS connection on the website
• Regular data backups
• Confidentiality obligations for all personnel and collaborators
• Regular updates of WordPress and its plugins (Fluent Forms, Fluent Booking, WPCode)
• In the event of a personal data breach, we notify the NAIH and affected data subjects in accordance with GDPR Arts. 33–34

11. International Data Transfers

As a general rule, we do not transfer personal data outside the EU/EEA. The sole exception is the use of Microsoft Teams for online meetings, where any transfer of personal data is carried out on the basis of Standard Contractual Clauses (SCCs) approved by the European Commission, providing appropriate safeguards within the meaning of GDPR Art. 46.

12. Rights of Data Subjects

Data subjects are entitled to exercise the following rights:

To exercise any of these rights, please contact us at info@synalist.com. We will respond without undue delay and in any event within 30 days of receipt of your request (GDPR Art. 12(3)).

13. Automated Decision-Making and AI

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on data subjects (GDPR Art. 22).

The automated evaluation of the quiz is limited to aggregating answers and sending the result; it does not constitute substantive decision-making.

Where we use AI tools in internal processes, those tools comply with the GDPR and the EU AI Act. Where such use involves personal data, we will inform the data subjects accordingly.

14. Protection of Children’s Data

Our services and website are not directed at persons under the age of 16. We do not knowingly collect personal data from minors. If we become aware that we have processed data relating to a person under 16, we will delete that data without undue delay.

15. Final Provisions

This Privacy Policy enters into force on 23 June 2026 and supersedes the previous version dated 5 April 2026.

We reserve the right to amend this Policy at any time. Amendments take effect upon publication on our website. In the event of material changes, we will also notify data subjects by email where we hold their email address.

For any data protection enquiries, please contact: info@synalist.com