Privacy Policy: ForgeMVP
1. Who is the data controller?
Name of the data controller: APPON LINE Kft.
Registered seat: Hungary, 2120 Dunakeszi, Római utca 1/1
Company registration number: 13-09-229851
Tax number: HU23137631
Contact e-mail: info@forgemvp.eu
This policy applies to the data processing of the forgemvp.hu website (hereinafter: the Website).
2. Scope of this policy and basic concepts
This policy has been prepared on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv., the Hungarian information act).
The Website is currently a static, informational marketing site (approximately 5 subpages: home, packages, about, contact, legal pages) that contains no user registration, account, or payment functionality. The only data-collecting function is the contact / quote-request form (on the /kapcsolat page).
The Website uses cookies, in the following categories:
- Strictly necessary cookies: required for the basic operation of the Website (e.g. maintaining the session); these do not require consent.
- Statistical (analytics) cookies: used to measure visits and understand how the Website is used. These are activated only with the data subject's prior consent.
- Marketing (advertising) cookies: used to display and target advertisements and measure their effectiveness (e.g. remarketing). These are activated only with the data subject's prior, explicit consent.
Statistical and marketing cookies are activated only after category-specific, prior consent given through the cookie consent banner shown on the Website. In the absence of consent, or if consent is withdrawn, these cookies are not placed, or are deleted. Consent can be changed or withdrawn at any time via the Website's cookie settings.
List of cookies actually in use:
| Cookie name | Category | Purpose | Lifetime | Provider |
|---|---|---|---|---|
[TODO: session cookie name] | Strictly necessary | Maintaining the session | End of session (until browser is closed) | APPON LINE Kft (own) |
[TODO: e.g. _ga, _ga_*] | Statistical | [TODO: e.g. traffic statistics — Google Analytics 4] | [TODO: e.g. 13 months / 2 years] | [TODO: e.g. Google Ireland Limited] |
[TODO: e.g. _fbp, _gcl_au] | Marketing | [TODO: e.g. ad targeting / remarketing — Meta Pixel, Google Ads] | [TODO: e.g. 90 days] | [TODO: e.g. Meta Platforms Ireland Ltd. / Google Ireland Limited] |
[TODO: this table is to be finalized once the concrete cookie tools (e.g. Google Analytics 4, Google Ads, Meta Pixel) are selected and go live, in sync with the actual category settings of the cookie consent banner.]
3. Scope and source of processed data: Contact / quote-request form
By filling in and submitting the form on the /kapcsolat page, the visitor voluntarily provides the following data:
| Data | Required? | Note |
|---|---|---|
| Name | Yes | For identification and addressing. |
| E-mail address | Yes | For replying and sending the quote. |
| Company name | No | Optional, background information. |
| Phone number | No | Optional contact detail. |
| Project description ("what would you like to build?") | Yes | The subject of the quote request. |
| Estimated budget range | No | Informational, category selection. |
| AI/human ratio preference | No | Informational, category selection. |
| Preferred deadline | No | Free text. |
| Acknowledgement of the privacy policy (checkbox) | Yes | A condition of submission. |
Upon form submission, the system automatically records the following technical data:
- IP address
- browser identifier (user-agent)
- the source page of the submission (which subpage the request came from)
- the language used for the submission (Hungarian/English)
- the time of submission
The system records this technical data for the purpose of defending against abuse (for example automated, bulk "spam" submissions) and operating the service securely; it does not serve primarily to identify the data subject.
There is no processing of health data or any other special category of data (Article 9 GDPR). Visitors may be explicitly warned not to enter such data into the form.
4. Purpose and legal basis of the processing
Purpose: Processing the quote request or contact initiated by the visitor, preparing and sending an individual quote, and maintaining contact between the parties up to any potential conclusion of a contract.
Legal basis: Taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR): the data subject provides their data on their own initiative, for the purpose of requesting a quote.
The legal basis for processing the technical data (IP address, user-agent, source page) is the legitimate interest of the data controller (Article 6(1)(f) GDPR) in operating the Website securely and filtering out abusive (bot, spam) submissions.
Providing the data is voluntary; if it is not provided, the data controller cannot process the quote request or contact the interested party.
No automated decision-making or profiling takes place.
5. Data transfers, recipients, data processors
- The system sends an internal e-mail notification about the incoming quote request to the ForgeMVP team of the data controller (current notification address:
info@appon.hu, which can be changed in the system settings). - An automatic confirmation e-mail is sent to the submitter's e-mail address.
- The data is stored in the data controller's own database (PostgreSQL). The data controller uses the following data processors, each under a signed data processing agreement (DPA):
- APPON LINE Kft: server operation and hosting.
- Amazon Web Services (Amazon SES): sending transactional e-mails (internal notification and customer confirmation). This service runs in an EU region (European data center), so this processing does not involve a transfer of data to a third country.
- Planned transfer, not yet live: in the future the data may also be handed over to an internal APPON ERP system, solely for the data controller's own business (customer-relationship-management) purposes. This transfer is not yet active at the time of publishing this policy: when it goes live, the policy must be updated.
- No data transfer to a third country (outside the EEA) takes place.
- The data is not disclosed or sold to any external, advertising, or marketing third party.
6. Duration of data storage
- If no contractual relationship arises from the quote request ("lost" / closed, inactive lead): the data controller processes the data for at most 1 year from the last contact, after which it is deleted or anonymised.
- If a contract arises from the quote request: the related data is retained in accordance with the 8-year retention obligation for accounting documents under Section 169(2) of Act C of 2000 on Accounting, and the limitation period for civil-law claims arising from the contract (Section 6:22 of the Hungarian Civil Code, typically 5 years).
- The technical data (IP address, user agent) is retained for 90 days; after this period the data controller deletes or anonymizes it, unless the associated lead record needs to be retained for another reason (e.g. an ongoing matter).
- Based on the data controller's decision, the system applies a so-called "soft-delete" (apparent deletion,
is_deletedflag); upon the data subject's deletion request (section 7), the data controller performs a permanent (physical) deletion.
7. Data security measures
The data controller ensures the security of the data through appropriate technical and organisational measures, in particular:
- the data is accessible only to authorised staff (admin interface, password-protected);
- the form has client-side and server-side validation and protection against automated (bot) submissions (hidden field, rate limiting);
- database access is logged, and the system applies an incident-management procedure in the event of unauthorised access or data loss.
In the event of a personal-data breach, the data controller is obliged under Article 33 GDPR to report it to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) within 72 hours of becoming aware of it, and, where justified, also to inform the data subjects (Article 34).
8. Rights of the data subject
Under Articles 15-22 GDPR, the data subject has the right to:
- request access to the personal data processed about them and to the circumstances of the processing (Article 15);
- request rectification if their data is inaccurate or incomplete (Article 16);
- request erasure ("right to be forgotten"), subject to the statutory exceptions (Article 17);
- request restriction of processing in certain cases (Article 18);
- request data portability, that is, to receive the data they have provided in a structured, machine-readable format, or to have it transmitted to another controller (Article 20);
- object to the processing where it is based on legitimate interest (Article 21).
A request to exercise these rights can be sent by the data subject to info@forgemvp.eu. The data controller fulfils the request without undue delay, but at the latest within one month of the receipt of the request, or informs the data subject of the reason for refusing the request.
9. Remedies
In the event of an infringement of their rights, the data subject may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):
- Address: 1055 Budapest, Falk Miksa utca 9-11.
- Postal address: 1363 Budapest, Pf. 9.
- Phone: +36 (1) 391-1400
- E-mail: ugyfelszolgalat@naih.hu
- Website: www.naih.hu
The data subject may also turn to a court in the event of an infringement of their rights; at the data subject's choice, the lawsuit may also be brought before the regional court of their place of residence or place of stay.
10. Amendment of this policy
The data controller reserves the right to unilaterally amend this policy, in particular in the event of a change in legislation or an expansion of the Website's functions (for example a new data-collection point or the introduction of a third-party service). The policy in force at any given time is available on the Website.
Date of last update: 2026.07.14