1. Controller and scope
Overon Kft., the operator of overonai.com, is the controller of your personal data. Overon AI is the company’s AI services business unit. The contact person for data protection matters is Managing Director Csaba Királyházi; you can reach us at [email protected].
This notice covers website visitors, contact form users, email enquiries and people booking an initial professional consultation. We process personal data under the General Data Protection Regulation (GDPR) and applicable Hungarian law.
2. Enquiries and requests for proposals
Data: your name, email address, optional company name, message, related correspondence and consultation details. We receive these directly from you. Your name, email address and message are needed to respond meaningfully; providing a company name is optional.
Purpose: responding to your enquiry, understanding your needs, arranging a professional consultation and preparing a proposal. We do not use these details for automatic newsletters or forward your messages to AI models for analysis or training.
Legal basis: where you request a proposal as an individual, taking steps at your request before entering into a contract [GDPR Article 6(1)(b)]. For business representatives, our legitimate interest in business communications and responding to enquiries [Article 6(1)(f)]. Acknowledging that you have read this policy is not marketing consent.
Retention: enquiry correspondence is retained for no longer than five years from receipt, depending on the need to handle the enquiry and clarify any related claims. We delete it earlier when it is no longer needed. If an order is placed, separate statutory retention requirements may apply to contractual and accounting records.
3. Booking and online meetings
The booking button opens a separate Google Calendar page. We use the name, email address, selected time and any additional booking information you provide to organise the meeting. Participation in Google Meet may also involve technical connection data.
The legal bases and retention approach for contact details are the same as for enquiries. The Google Privacy Policy also applies to Google’s operation of its booking and video conferencing services.
4. Technical data, security and cookies
Cloudflare may process technical data such as your IP address, browser information, request time and requested URL to serve and protect the website. The legal basis is our legitimate interest in secure and reliable operation [GDPR Article 6(1)(f)]. Retention of provider-side technical data depends on the relevant service configuration, the security purpose and Cloudflare’s terms; further details are available on request.
The form’s abuse protection uses a keyed identifier derived from the IP address and a submission counter for up to 15 minutes, and a random duplicate-submission identifier for up to six hours. The form does not create a separate customer database: messages are delivered to our business mailbox.
The website’s own code does not use analytics or marketing cookies and does not create visitor profiles. Cloudflare may use technologies needed for delivery and security. Google pages opened separately are subject to their own privacy and cookie rules.
The website has no user registration, online payment or newsletter subscription.
5. Service providers, recipients and transfers
Staff authorised to respond to enquiries may access the relevant data. We use these services:
- Cloudflare: hosting, network delivery, forwarding contact form submissions and security. Privacy Policy · Data Processing Addendum.
- Google: Google Workspace email, the Apps Script message receiver, Google Calendar and Google Meet. Privacy Policy · Data Processing Addendum.
These services operate globally and may process data outside the European Economic Area. Such transfers rely on the safeguards in the providers’ terms consistent with GDPR Chapter V, such as an applicable adequacy decision or standard contractual clauses. Information about the relevant safeguards is available through those terms or from our contact address.
We do not sell personal data. We disclose data to authorities only where there is a lawful basis and a legitimate request, and only to the extent necessary.
6. Data security and automated decisions
The website uses HTTPS. Access is restricted to what is needed for the relevant task, and form submissions are forwarded through an authenticated server connection. We use technical and organisational measures to help prevent unauthorised access, alteration and loss.
We do not use solely automated decision-making or profiling in connection with this website that produces legal or similarly significant effects on you.
7. Your rights and how to exercise them
Subject to the applicable legal conditions, you may request information, access, rectification, erasure or restriction. You may object to processing based on legitimate interests on grounds relating to your particular situation. Data portability applies under the conditions of the GDPR, in particular to automated processing based on consent or contract. Where separate processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.
Send requests to [email protected]. We respond without undue delay, generally within one month. For complex or numerous requests, this may be extended by up to two additional months; we will explain the extension within the first month. We may verify your identity proportionately where necessary.
8. Complaints and remedies
You can contact us directly with privacy questions or complaints. You may also seek a judicial remedy or complain to the supervisory authority in the place of your habitual residence, workplace or the alleged infringement.
In Hungary, the supervisory authority is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH). Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary; postal address: 1363 Budapest, Pf. 9., Hungary. Current contact details and complaint procedures are available on the official NAIH website.
9. Updates to this notice
We update this notice when our operations, providers or applicable rules change. The current version is available on this page with its effective date. We provide separate information at collection for additional processing associated with a specific service or order.