Privacy Notice (GDPR)

1. Controller details

• Company name: Ackbar Seli Kft.
• Registered office: 1194 Budapest, Kócsag utca 41.
• Tax number: 24676098-2-43
• Company registration number: 01-09-176795
• E-mail: hello@infinik.hu
• Phone: +36 20 516 8706
• Data protection contact: Szellmann Réka

2. Principles of data processing

Ackbar Seli Kft. (hereinafter: Infinik, we) processes personal data in accordance with the General Data Protection Regulation (GDPR, Regulation 2016/679/EU) and Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.).

The principles of our data processing:

• Lawfulness, fairness, transparency: we only process data on a legal basis and with your knowledge
• Purpose limitation: we only collect data for specified, explicit purposes
• Data minimisation: we only process the minimum data needed for the given purpose
• Accuracy: we keep the data up to date
• Storage limitation: we only store the data for as long as necessary
• Integrity and confidentiality: we protect the data with appropriate technical and organisational measures

3. What data do we process and why?

3.1 Registration and ordering (for B2B customers)

Data we process:

Contact details (full name, company e-mail address, phone number), password (stored encrypted with a cryptographic algorithm), basic company data (company name, registered office and billing address, tax number), company-specific data (industry, headcount, and optionally the size of the department), IP address. If you sign in with a Google account (SSO), we process the basic profile data Google shares (name, e-mail address).

Purpose of processing:

• Identification and access: Creating the account and ensuring secure sign-in
• Providing the service and pricing: The headcount (or department size) is needed to determine the right pricing category and to track the number of survey responses (80% is needed for a representative survey)
• Customer support (phone number): Quick and efficient solving of operational problems related to delivering the service
• Analysis and development: Industry data is needed for the statistical analysis of our B2B customer base and for more targeted development of our product

Legal basis:

• GDPR Art. 6(1)(b) - Processing necessary for the performance of a contract (account, pricing, generating the survey, operational contact)
• GDPR Art. 6(1)(f) - Legitimate interests of the controller (producing industry statistics, internal analytics, ensuring the quality of B2B customer service). We judge that this processing does not disproportionately restrict the fundamental rights and freedoms of data subjects, given that it only aims at producing aggregated, business-purpose statistics and the data subject is the representative of a business

Retention period:

30 days from the deletion of the registration/account (so that it can be restored), after which we delete it without delay - except for the contact and company data that appear on invoices (we keep these for 8 years because of the Accounting Act).

3.2 Payment and invoicing

Data we process:

Billing name, billing address (when you buy as an individual, your own name and the billing address you give), tax number (for companies), the ID of the payment transaction (we do not store bank account or card data - only Barion Payment Zrt. handles those). Barion Payment Zrt. also receives the billing address for card payments, and KBOSS.hu Kft. (Számlázz.hu) receives the name, address and tax number to issue the invoice.

Purpose of processing:

Issuing invoices, keeping financial records, meeting legal obligations.

Legal basis:

GDPR Art. 6(1)(c) - Compliance with a legal obligation (Act C of 2000 on Accounting, Act CXXVII of 2007 on Value Added Tax).

Retention period:

Under the Accounting Act we are obliged to keep the data related to invoices for 8 years, counted from the financial year.

3.3 Providing the service (using the application)

Data we process:

Sign-in times, a log of the actions performed in the system (e.g. creating or editing a survey, exporting data), IP address, browser type.

Purpose of processing:

Ensuring the secure and proper operation of the service, detecting and fixing errors, preventing abuse, and ensuring auditability.

Legal basis:

GDPR Art. 6(1)(f) - Legitimate interests of the controller (secure operation of the service, prevention of abuse).

Retention period:

We keep security logs and infrastructure audit logs for up to 1 year.

3.4 Marketing communication (optional, based on consent)

Data we process:

E-mail address.

Purpose of processing:

Sending informational and promotional e-mails (newsletter) about Infinik's products, services and professional content.

Legal basis:

GDPR Art. 6(1)(a) - The data subject's voluntary consent.

Retention period:

Until you withdraw your consent. You can unsubscribe at any time by clicking the “Unsubscribe” link at the bottom of the newsletter, or at hello@infinik.hu.

3.5 Website visits

Data we process:

IP address, pages visited, time and duration of the visit, browser type.

Purpose of processing:

Operating the website securely, measuring its traffic, and preventing abuse (e.g. fraud).

Legal basis:

GDPR Art. 6(1)(f) - Legitimate interests (secure operation of the website).

Retention period:

Up to 90 days.

3.6 The account created when you book or receive a gifted product

Data we process:

Full name, e-mail address, and when booking the free consultation, your phone number as well.

Purpose of processing:

When you book the free consultation, or when someone gifts you a product, we create an account in your name that stores your booking and your products. This account cannot be used to sign in or pay until you take it over. We e-mail the takeover link to your address, and knowing the e-mail address alone is not enough to take the account over: only the link sent to your address entitles you to it. This way nobody can take over your account (and the booking and products in it) just because they know your e-mail address.

Legal basis:

GDPR Art. 6(1)(b) - Processing necessary for the performance of a contract (fulfilling the booking, or receiving the gifted product).

Retention period:

If you do not take over the account, we permanently delete it 30 days after the date of your last booking has passed and you have no usable sessions left, together with your bookings, products and billing data. If you take it over, the retention period described in section 3.1 applies. You can ask for your account and its data to be deleted at any time, even earlier than this.

3.7 Products paid for by your company

Data we process:

If you book a session from the company pool your company bought: your name, the date of use, the type of product (e.g. coaching / mentoring session, VibeCheck consultation), and whether the session went back into the pool because of a cancellation.

Purpose of processing:

Your company paid for the pool, so the company account shows who used a session from it and when. Every member of the company account can see this, not just management or HR. They cannot see what happened in the session, though: its content and the related materials belong to your own account. If you don't want your company to see your booking, you can also buy a package as a private individual, and the use of your own sessions does not appear in the company account.

Legal basis:

GDPR Art. 6(1)(f) - Your company's legitimate interest in seeing what the pool it paid for was spent on. For this we only show the minimum data listed above.

Retention period:

We keep the usage record together with the related invoice for 8 years, because it proves what your company received for the pool it paid. Your name is shown next to it for as long as your account exists (according to the retention period described in section 3.1), after that the usage stays in the pool's records without a name.

3.8 The description you give when booking

Data we process:

When you book a VibeCheck consultation, you can describe in your own words what bothers you the most. The field is optional.

Purpose of processing:

We use the description to prepare for the consultation. It goes into the calendar event of the booking, to which our colleagues running the consultation and you receive an invitation, and into the confirmation e-mail sent to you. Once the booking is made, we also keep the description in your VibeCheck record, so that you can see it in your workbook and edit it until the consultation starts - if you edit it, the calendar event is updated too. If your company paid for the VibeCheck from its pool, every member of your company can see the description, on the same basis as the usage described in section 3.7; if you paid, only you and our colleagues running the consultation can see it. Please do not include health data or other special category data in it, and do not name other people in it.

Legal basis:

GDPR Art. 6(1)(b) - Processing necessary for the performance of a contract (the consultation).

Retention period:

If no booking is made after payment, we permanently delete the description stored on our server within 25 hours at the latest. If the booking is made, we keep the description for as long as your account exists (under section 3.1, or under section 3.6 for an account that was gifted or created at booking).

3.9 Orders of the company account

Data we process:

If you belong to your company's account: the date, content (e.g. type and number of surveys or sessions), amount and status (paid, pending) of the orders placed on behalf of your company, and the name of the person who placed them.

Purpose of processing:

The company pays for the orders placed in its name, so it needs to see what was ordered and who handled it - on the same basis as for the use of the company pool (section 3.7). Every member of the company account sees the same, not just management or HR. If you don't want your company to see your purchase, you can also pay as a private individual - it stays in your own account and does not appear in the company list.

Legal basis:

GDPR Art. 6(1)(f) - Your company's legitimate interest in seeing what was spent in its name and on whose decision. For this we only show the minimum data listed above: the content of the order and the name of the person who placed it, nothing else.

Retention period:

We keep the order together with its invoice for 8 years, under the Accounting Act.

3.10 Workbook

Data we process:

The notes and next steps recorded in the workbook, written by you and our relevant experts, our suggestions, and the action plan of a results consultation.

Purpose of processing:

Providing the service and following up on it. Every member of your company can see the workbook of a company survey. Only you and our relevant experts can see the workbook of a VibeCheck, unless your company paid for the VibeCheck from its pool: in that case, on the same basis as described in section 3.7, every member of your company can see it too. Only you and our relevant experts can see your coaching and mentoring workbook, even if your company paid for it; your company only sees the session used (section 3.7). Our relevant experts can also edit the entries of the workbook; if we change yours, we mark it. Please do not put health data or other special category data here either, and do not include the names of other people.

Legal basis:

GDPR Art. 6(1)(b) - Processing necessary for the performance of a contract.

Retention period:

We keep the workbook of a survey for as long as the survey exists. We keep the workbook of a VibeCheck, coaching or mentoring for as long as your account exists (under section 3.1, or under section 3.6).

4. Processors and partners

We pass data to the following carefully selected partners (processors):

• Amazon Web Services EMEA SARL: Hosting, database, e-mail sending. (EU data centre, Frankfurt)
• Barion Payment Zrt.: Online payment processing, fraud prevention. (EU, Hungary)
• KBOSS.hu Kft. (Számlázz.hu): Issuing invoices. (EU, Hungary)
• Cloudflare, Inc.: Content delivery (CDN), DNS management, security filtering. (EU servers, based on Standard Contractual Clauses - SCC)
• Google: Google Sheets (collecting survey answers), Google Calendar (bookings), Google Analytics and Ads (only anonymous signals without your consent)
• YouTube: Embedded videos. The video only loads when you click play
• Meta Platforms Inc.: Meta Pixel (only with your consent)
• Metricool: Visit statistics (without cookies, with IP address logging)

The data of Infinik's system is in the AWS Frankfurt region. We may pass data to authorities (e.g. the Hungarian Tax and Customs Authority, NAV, or the Hungarian data protection authority, NAIH) where we are legally obliged to.

5. Your rights

You can send your requests to hello@infinik.hu, and we answer in writing within 30 days.

• Right of access: You can ask us to tell you what data we process about you and to give you a copy of it
• Right to rectification: You can ask for inaccurate or incomplete data about you to be corrected
• Right to erasure (“right to be forgotten”): You can ask for your data to be deleted if the purpose of the processing has ceased and there is no legal obligation to keep it
• Right to restriction of processing: You can ask us not to process your data for the time being
• Right to data portability: You can ask for your data in a machine-readable format (e.g. JSON or CSV)
• Right to object: You can object to processing based on legitimate interests
• Withdrawal of consent: If the processing is based on consent, you can withdraw it at any time

6. Automated decision-making and profiling

We do not use automated decision-making (e.g. scoring or rating based on artificial intelligence) that would have legal effects on you or would significantly affect you.

7. Data security

• Encryption: All connections are protected with SSL/TLS encryption. The database uses server-side encryption (AWS KMS). We store passwords using a one-way cryptographic hash algorithm.
• Access restriction: Only authorised persons can access the data (Row-Level Security).
• Audit log: We log every critical operation so that abuse can be detected.

In case of a personal data breach, we notify NAIH within 72 hours under Article 33 of the GDPR, and where necessary we also inform you without delay.

8. Cookies and tracking technologies

Strictly necessary cookies

Session cookies that are essential for the website and the application to work. They do not require your consent, because the service would not work without them.

Barion Pixel (fraud prevention)

We use the Barion Pixel operated by Barion Payment Zrt. on our website solely for the security of payment transactions and for fraud prevention. Barion has a legal and contractual obligation to carry out a risk analysis during payment processes in order to filter out abuse. With our settings, the Barion Pixel does not collect marketing or analytics data, and we automatically reject the marketing consent.

The following cookies are placed in your browser by Barion Payment Zrt. on the basis of legitimate interests (GDPR Art. 6(1)(f)), without consent, solely for fraud prevention:

Other technology: Browser fingerprinting is a fraud prevention tool used as part of the Barion Smart Gateway. Details are in chapter 5.4 of Barion's privacy notice (in Hungarian).

Statistics cookies (consent required)

With Google Analytics 4 (GA4) we collect anonymous, aggregated visit statistics to improve the website. We only place these cookies with your consent (Google Consent Mode v2). We ask for consent with the cookie banner shown on the website, and you can change your choice at any time. Without consent, Google Analytics does not place any cookie. Because of Google Consent Mode, an anonymous signal without a cookie identifier that the page was opened may still be sent to it.

Your consent applies on the website and in the application alike (infinik.hu and app.infinik.hu) - you don't need to accept or reject separately on both. We store your decision in a cross-subdomain cookie (domain=.infinik.hu), which you can withdraw at any time in the cookie banner.

Metricool traffic measurement (without consent)

We use the Metricool analytics service without consent to measure the traffic of our website. Metricool does not use cookies, but it logs IP addresses for visit statistics; Metricool processes this data in anonymised form and does not link it to any personal identifier. More about Metricool's data processing: metricool.com/privacy-policy.

Google Ads conversion tracking (consent required)

We use Google Ads conversion tracking to measure how many visitors take a valuable action on the website (e.g. registration, getting in touch) as a result of our Google ads. Conversion tracking is only activated with your consent (Google Consent Mode v2, ad_storage, ad_user_data, ad_personalization permissions). Without consent, Google Ads does not place a cookie and does not build a profile of you, only an anonymous signal without a cookie identifier may be sent to it. More about Google's data processing: policies.google.com/privacy.

Meta Pixel (consent required)

We use the Meta Pixel provided by Meta Platforms Inc. to measure how many visitors take a valuable action on the website as a result of our Facebook and Instagram ads, and to improve the effectiveness of the ads. The Meta Pixel is only activated with your consent. The pixel's script loads before your consent too, but it does not send any data: the fbq('consent', 'revoke') setting prevents personal data from being sent. More about Meta's data processing: facebook.com/privacy/policy.

Appointment booking

To book a VibeCheck consultation, we provide an embedded calendar on the website. When you book, we ask for your name and e-mail address, and for the free consultation your phone number as well - we process this data on our server, and to record the booking we create a Google Calendar event through our service account. The booking interface does not load a separate Google script, the calendar integration is only a server-side (Google Calendar API) connection. More about Google's data processing: policies.google.com/privacy.

9. Remedies

If you have a question or a complaint about our data processing practices, please contact us first at hello@infinik.hu, and we will investigate your case within 30 days.

If you feel that our data processing violates the GDPR or the Infotv., you can turn to the following authority:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, the Hungarian data protection authority)

• Address: 1055 Budapest, Falk Miksa utca 9-11. | Postal address: 1363 Budapest, Pf.: 9.
• E-mail: ugyfelszolgalat@naih.hu
• Website: www.naih.hu

If your rights are violated, you can also go to the competent regional court (törvényszék) for your place of residence or stay in civil proceedings.

10. Changes to this notice

We reserve the right to change this notice, especially if our services, the law or our data processing practices change. We notify you of changes at least 7 days in advance by e-mail or with a notice published on the website.

The current notice is always available at: infinik.hu/en/privacy

The Terms and Conditions (ÁSZF) are available at: infinik.hu/en/terms

You're a true data protection warrior if you made it this far 🛡️ We really appreciate it when someone is this thorough!