Who is responsible
Datadeft Korlátolt Felelősségű Társaság (Datadeft Kft.) operates OpexOpt and is the controller for the personal data described here. Our registered address is 2473 Vál, Barack dűlő 49., Hungary.
For privacy questions or requests, email hello@opexopt.eu. This notice covers the OpexOpt website at www.opexopt.eu and review requests sent to us. Information for customer workspaces and client engagements is provided with that service.
Website requests
Our hosting provider, Amazon Web Services (AWS), processes your IP address and technical request information to deliver the website. Access logs include the request time, requested address, referring page, browser information, response status, and connection details.
We use these records only to operate the website, diagnose faults, and investigate security incidents. The legal basis is our legitimate interest in a reliable and secure website, under Article 6(1)(f) GDPR.
Access logs are stored in the EU (Frankfurt, Germany) and deleted automatically 90 days after creation.
We do not use analytics scripts, advertising pixels, session recordings, or embedded social widgets. The website does not make automated decisions about you or profile you.
Review requests by email
The review request form does not send or store anything on its own. It opens your email app with a message addressed to hello@opexopt.eu. We only receive what you choose to send.
We ask for the minimum we need to reply: your work email, your company, what you are planning, and optionally the decision you are working toward. Your email also includes your name if your email app adds it, and standard email metadata. Please do not send billing exports, credentials, or other sensitive information in a review request. We agree what data is needed during scoping.
When you ask us to take steps toward a contract, the legal basis is Article 6(1)(b) GDPR. For other business correspondence, including contact on behalf of a company, it is our legitimate interest in responding to enquiries under Article 6(1)(f).
If a request does not lead to an engagement, we delete the correspondence 12 months after our last exchange. If it leads to an engagement, the correspondence becomes part of that engagement's records. We keep information longer only when the law requires it or to establish, exercise, or defend a legal claim.
Cookies and storage
The public pages set no cookies and need no consent banner. They follow your device's light or dark setting. If you use the theme button, your choice is kept in your browser's session storage for that tab, under the name opexopt-theme. It contains only “light” or “dark”, is never sent to us, and is removed when you close the tab.
Customer sign-in at /login/ uses one strictly necessary session cookie, set only when an invited customer signs in, and removed when they sign out or the session expires. It is used only to keep that customer signed in to their company workspace.
Fonts and illustrations are served with the website. External websites receive a request only when you follow a link to them, and their own privacy notices apply.
Providers and international transfers
AWS provides hosting, content delivery, and access-log storage. Email is delivered through Fastmail. These providers process the information needed to supply their services. Access within Datadeft Kft. is limited to people handling the request or operating the service. Information may also be disclosed where required by law.
Website files and access logs are stored in AWS's Frankfurt region. CloudFront operates globally, and delivery or support may involve processing outside the European Economic Area. Fastmail also processes data internationally, including in the United States and Australia.
The providers' data processing terms include EU Standard Contractual Clauses for relevant international transfers. See AWS's data protection information and Fastmail's Data Protection Agreement. Contact us for information about the safeguards relevant to your data.
Your rights
Depending on the circumstances, you can request access, correction, deletion, or restriction of your personal data. You may also have a right to data portability. You can object to processing based on legitimate interests on grounds relating to your situation.
Send requests to hello@opexopt.eu. We normally respond within one month. If an extension is permitted for a complex request, we will explain it within that month. We may ask for information needed to verify your identity.
Complaints
You can complain to a data protection authority in the country where you live or work, or where the alleged infringement occurred. In Hungary, this is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).
NAIH's address is 1055 Budapest, Falk Miksa utca 9–11, Hungary. Its postal address is 1363 Budapest, Pf. 9. See NAIH's official complaint channels for how to submit a complaint.