( Privacy )
Privacy policy.
Last updated: October 14, 2026
This English version is provided for convenience. If it differs from the Hungarian original, the Hungarian version prevails.
This policy describes what personal data we process when you use frammble.com and request a quote, for what purposes, and what rights you have.
01 The data controller
Name and contact details of the data controller:
- Name
- Baranyi Zoltán EV.
- Trading name
- FRAMMBLE
- Registered address
- 5123 Jászárokszállás, Rozmaring utca 34.
- Registration number
- 62271804
- Tax number
- 92030961-1-36
- info@frammble.com
- Phone
- +36 30 944 3765
- Website
- https://frammble.com
- Representative
- Baranyi Zoltán, sole proprietor (egyéni vállalkozó)
Data protection officer
Under Article 37 of the GDPR, the Controller is not required to designate a data protection officer and has not designated one, because its activities involve neither regular and systematic monitoring of personal data on a large scale nor large-scale processing of special categories of data. Inquiries about data processing can be sent to info@frammble.com.
02 The data we process
Quote request form
When you fill in the quote request form, the following data is processed:
| Data | Required / optional | Why we process it |
|---|---|---|
| Name | required | identification, addressing you, communication |
| Email address | required | sending the quote and our reply |
| The service you select | required | preparing the quote |
| Free-text message (brief) | optional | understanding the task, pricing |
| Uploaded files and their contents | optional | understanding the task, pricing |
| Company name, phone number | optional | concluding a contract, faster coordination |
| Time the message was sent | automatic | tracking the handling of the request |
The Controller does not ask for or expect special categories of data under Article 9 of the GDPR (for example health data, political opinions, or religious beliefs). Please do not include such data in your message or in uploaded files.
A separate note on uploaded files. If uploaded material (for example a photo, a video, earlier campaign material, or a script) also contains the personal data or likeness of a third party, the Controller acts as a data processor or as an independent controller with respect to that data, depending on the nature of the engagement. The uploader warrants that they are entitled to hand over the material and that they have properly informed the persons concerned and — where necessary — obtained their consent.
Filling in the form is voluntary. A quote request cannot be sent without the required fields, because without them the Controller cannot provide a quote.
Technical data
While the website is running, the hosting provider's system may automatically log technical data about visits. This typically includes:
- the visitor's IP address (partially or fully anonymized, depending on the provider's settings),
- the time of the request (timestamp),
- the address (URL) of the subpage visited and the referring page,
- the type and version of the browser and operating system (user agent),
- the result of the request (HTTP status code) and the amount of data transferred.
The Controller does not link this data to the data entered in the form and does not use it to identify visitors. Logging serves to operate the website securely and reliably, to fix errors, and to filter out abuse (for example automated attacks or spam). Legal basis: the Controller's legitimate interest (GDPR Article 6(1)(f)).
Server logs are processed by the hosting provider under its own data processing policy, typically for 30 days. The hosting provider's details are given in section 5.
The website currently does not use any tracking code for analyzing visitor behavior for statistical or advertising purposes.
03 Purposes and legal bases of processing
| # | Purpose | Data processed | Legal basis (GDPR Article 6(1)) |
|---|---|---|---|
| 1 | Processing quote requests, providing quotes | name, email, service, message, files | point (b) — steps taken at the request of the data subject prior to entering into a contract; for a natural person acting on behalf of a company, point (f) (legitimate interest: establishing business contact) |
| 2 | Communication during the project | name, email, phone number, contact person details | point (b) (performance of a contract); for contact persons, point (f) |
| 3 | Concluding and performing the contract, delivery | contract and billing data, project materials | point (b) |
| 4 | Invoicing, accounting and tax obligations | billing name, address, tax number, email, invoice details | point (c) — legal obligation (Section 169 of Act CXXVII of 2007 on Value Added Tax (Áfa tv.), Section 169 of Act C of 2000 on Accounting (Szt.), Act CL of 2017 on the Rules of Taxation (Art.)) |
| 5 | Handling complaints, consumer disputes | complaint details, contact details | point (c) (Section 17/A of Act CLV of 1997 on Consumer Protection (Fgytv.)) |
| 6 | Establishing, exercising, and defending legal claims | contract documentation, correspondence | point (f) — legitimate interest |
| 7 | Secure operation of the website, logging | technical data (section 2) | point (f) — legitimate interest |
| 8 | Showcasing the finished work as a reference | the client's name / brand name, the work | point (a) — consent, or an express provision set out in the contract; consent can be withdrawn at any time |
| 9 | Newsletter, marketing outreach (if any) | name, email | point (a) — consent (Section 6 of Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (Grt.)) |
Balancing of interests. For processing based on legitimate interest (rows 6 and 7), the Controller has carried out a balancing test and concluded that the processing is necessary and proportionate to achieve its purpose and has little impact on the rights of data subjects, because the scope of the data is narrow, the Controller does not use it for profiling, and does not pass it to third parties for marketing purposes. We will share the result of the balancing test on request at info@frammble.com.
04 How long we keep data
| Processing | Retention period | Counted from |
|---|---|---|
| Quote requests that did not lead to a contract | 1 year | the last substantive contact |
| Temporary upload storage for the quote request form | Automatic deletion rule of 1 day | the upload; the provider then removes the expired object, typically within a further 24 hours |
| Quote request files delivered by email | 1 year if no contract is concluded | the last substantive contact |
| Contract documentation, correspondence, brief, approvals | 5 years | performance of the contract (the general limitation period under Section 6:22 of Act V of 2013 on the Civil Code (Ptk.)) |
| Source files of finished works, project archive | 2 years | delivery |
| Invoices and accounting records | 8 years | the last day of the financial year in which the annual report for that financial year is adopted (Section 169(2) of the Szt.) |
| Tax records | at least 5 years | the last day of the calendar year in which the tax return had to be filed (Art.) |
| Complaints and our replies to them | 5 years | receipt of the complaint (Section 17/A(7) of the Fgytv.) |
| Server logs | 30 days | logging |
| Consent-based processing (reference, newsletter) | until consent is withdrawn, for at most 5 years | the giving of consent |
Once the retention period expires, the Controller deletes the data irreversibly. If data is needed on more than one legal ground, the longest retention period applies.
05 Data processors and data transfers
To provide its services, the Controller uses the data processors listed below. Processors handle data solely on the Controller's instructions, under a contract that meets Article 28 of the GDPR.
a) Website and file storage
Cloudflare, Inc. — 101 Townsend St., San Francisco, CA 94107, United States of America — cloudflare.com — serving the website and temporary R2 storage of attachments, protected by a one-day automatic deletion rule. Data processed: technical log data (IP address, timestamp, user agent), uploaded files, and their technical metadata.
b) Outgoing email delivery
Resend, Inc. — resend.com — delivering the owner's copy of the quote request and the automatic confirmation. Data processed: name, email address, service, message, and attachments. Resend downloads attachments through a short-lived, signed storage link.
c) Incoming email storage
Zoho Corporation Pvt. Ltd. — Estancia IT Park Pvt Ltd, Plot No. 140–151, GST Road, Vallancherry Village, Chengalpattu Taluk, Kanchipuram District 603 202, India — storing and forwarding mail received at info@frammble.com. Data processed: all data and attachments contained in the correspondence.
d) Invoicing
KBOSS.hu Kereskedelmi és Szolgáltató Kft. (Számlázz.hu) — registered address: 1031 Budapest, Záhony utca 7.; company registration number: 01-09-303201; tax number: 13421739-2-41; data protection contact: dpo@kboss.hu — issuing and storing invoices and reporting data to the Online Invoice system (Online Számla) of the Hungarian National Tax and Customs Administration (NAV). Data processed: billing name, address, tax number, email address, invoice line items.
e) Production tools (generative AI services)
The Controller uses generative artificial intelligence services to produce visual content. If material provided by the client (for example a product photo, a logo, or a reference image) contains personal data or a likeness, and that material has to be uploaded to such a service during production, the service provider qualifies as a data processor. The providers used may differ from project to project; the current list can be requested at info@frammble.com. Providers typically used at the time this policy was adopted:
- Higgsfield AI — 535 Mission Street, 14th Floor, San Francisco, CA 94105, United States of America — image and video generation
The Controller designs its production process so that personal data is uploaded to such services only to the extent strictly necessary and, where possible, uses a subscription plan under which uploaded content is not used for model training.
f) External resources loaded by the website
The website serves the fonts and code libraries it needs for display from its own servers. Your browser does not connect to Google Fonts or jsDelivr to load them, so no IP address or browser data related to your use of the website is transmitted to either of these two providers.
g) Transfers to third countries
Some of the Controller's service providers are established outside the European Economic Area, mostly in the United States of America, so data is transferred to a third country. In these cases, the legal basis for the transfer is:
- the European Commission's Implementing Decision (EU) 2023/1795 on the adequacy of the EU–US Data Privacy Framework, where the provider in question is certified under the framework; or
- the standard contractual clauses (Standard Contractual Clauses) adopted by the European Commission's Implementing Decision (EU) 2021/914, supplemented — where necessary — by additional technical and organizational safeguards (for example encryption and data minimization).
Data subjects can request information about the specific safeguards, and a copy of the relevant documents, at info@frammble.com.
Transfers to authorities: the Controller may transfer data on the basis of a legal obligation, in response to a request from an authority (for example NAV, a court, or an investigating authority). It does not sell or pass on data to third parties for marketing purposes.
06 Cookies
Current state of the website. The frammble.com website currently does not use any tracking, statistical, or advertising cookies. While you use the website, your browser's session storage (sessionStorage) is used to store the state of transitions between pages in your browser. It is deleted automatically when you close the tab, and its contents are not transmitted to the Controller. If you pick a language with the language switcher, a single, strictly functional cookie remembers your choice so that the home page appears in that language next time; the cookie contains no personal data. These technologies are strictly necessary for the website to work or to provide a feature you have explicitly requested, so under Section 155(4) of Act C of 2003 on Electronic Communications (Eht.) and the GDPR they do not require consent.
| Name | Type | Purpose | Lifetime | Consent required |
|---|---|---|---|---|
fr_nav, fr_seen |
sessionStorage (not a cookie) | preserving the state of the page transition animation and the intro animation | until the browser tab is closed | no |
frammble_locale |
functional cookie | remembering the language selected in the language switcher | 1 year | no |
If the Controller introduces statistical (for example Google Analytics, Plausible) or advertising (for example Meta Pixel) technology in the future, it will do so only on the basis of prior, explicit consent collected through a cookie settings interface, and will update this policy accordingly.
Changing your settings. You can change or block the use of session storage and cookies in your browser settings at any time (Chrome, Firefox, Safari, Edge: Settings → Privacy and security). If you block strictly necessary technologies, some features of the website will not work properly.
07 Your rights as a data subject
The person whose data is processed (hereinafter: Data Subject) has the following rights.
a) Right to information and access (GDPR Articles 13–15)
You can ask us to tell you whether we process personal data about you and, if so, what data, for what purpose, for how long, and to whom we transfer it. You can also request a copy of the data processed. The first copy is free of charge.
b) Right to rectification (GDPR Article 16)
You can request that inaccurate data be corrected and incomplete data be completed.
c) Right to erasure — “right to be forgotten” (GDPR Article 17)
You can request the erasure of your data if it is no longer needed for the purpose for which we collected it; if you have withdrawn your consent and there is no other legal basis; if you have objected to the processing and there are no overriding legitimate grounds; or if the processing was unlawful. The right to erasure cannot be exercised where the processing is necessary to comply with a legal obligation (for example keeping invoices for eight years) or to establish, exercise, or defend legal claims.
d) Right to restriction of processing (GDPR Article 18)
You can request that processing be restricted (that the data be “locked”) if you contest the accuracy of the data — for the period needed to verify its accuracy; if the processing is unlawful but you do not want the data erased; if we no longer need the data but you need it to pursue a legal claim; or while your objection is being assessed.
e) Right to data portability (GDPR Article 20)
You can receive the data processed about you by automated means on the basis of consent or a contract in a structured, commonly used, machine-readable format (for example CSV or JSON), and you can request that it be transmitted to another controller where technically feasible.
f) Right to object (GDPR Article 21)
You can object to processing based on legitimate interest. In that case we will stop the processing, unless we demonstrate compelling legitimate grounds that override your interests and rights, or grounds related to establishing, exercising, or defending legal claims. Where data is processed for direct marketing purposes, an objection takes effect without restriction and without the need to give reasons, and we will delete the data for that purpose without delay.
g) Right to withdraw consent (GDPR Article 7(3))
For processing based on consent (for example showcasing work as a reference, or a newsletter), you can withdraw your consent at any time, without giving reasons and free of charge. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
How to submit a request
You can submit your request in the following ways:
- by email: info@frammble.com
- by post: 5123 Jászárokszállás, Rozmaring utca 34.
Please state in your request which right you wish to exercise and — if the request concerns only part of your data — which data it concerns. If we have reasonable doubts about the identity of the person making the request, we may ask for additional information to confirm their identity under Article 12(6) of the GDPR. The sole purpose of this is to make sure we do not disclose your data to an unauthorized person.
Response time
We will act on your request within one month of receipt at the latest and inform you in writing. Taking into account the complexity and number of requests, this period may be extended by a further two months; we will inform you of any extension and the reasons for it within one month of receiving the request. If we do not take action on your request, we will inform you within one month at the latest of the reasons, and of your right to lodge a complaint with the supervisory authority and to seek a judicial remedy.
Taking action is free of charge. If a request is manifestly unfounded or excessive — in particular because of its repetitive character — we may charge a reasonable fee or refuse to act on the request.
08 Remedies and complaints
Complaints to the Controller. If you have a question or concern about data processing, please contact us directly first at info@frammble.com — that is the quickest way to resolve most issues.
Complaints to the supervisory authority. Under Article 77 of the GDPR and Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.), you can lodge a complaint with the Hungarian supervisory authority:
- Authority
- Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH)
- Registered address
- 1055 Budapest, Falk Miksa utca 9-11.
- Mailing address
- 1363 Budapest, Pf.: 9.
- Phone
- +36 (1) 391-1400
- ugyfelszolgalat@naih.hu
- Website
- naih.hu
Going to court. Under Section 23 of the Infotv. and Article 79 of the GDPR, you can take legal action if you believe the Controller has breached the applicable legal provisions in processing your personal data. Such cases fall within the jurisdiction of the regional courts (törvényszék), and — at your choice — you can also bring the case before the regional court for the place where you live or are staying. Contact details of the regional courts: birosag.hu. The court handles such cases as a matter of priority. If the Controller causes you damage by unlawfully processing your data, or infringes your personality rights, you can claim compensation for damages or restitution for the infringement (sérelemdíj).