Privacy Policy — Noviram Digital Kft.

1 The controller

Controller: Noviram Digital Korlátolt Felelősségű Társaság
Registered office: 1068 Budapest, Városligeti fasor 24.
Registration number: 01-09-459181
Tax number: 33101787-2-42
Represented by: Czine Christopher József, managing director
Email (including privacy enquiries): info@noviram.com
Website: https://noviram.com

(the Controller)

We accept privacy enquiries at the email address above. The need to appoint a data protection officer must be confirmed in the pre-launch review, based on the actual processing activities.

2 Principles and definitions

2.1. The Controller processes personal data lawfully, fairly and transparently, for specified purposes, to the extent and for the time necessary to achieve those purposes, accurately and with appropriate security measures (Article 5 GDPR).

2.2. Personal data: any information relating to an identified or identifiable natural person (a data subject). Processing: any operation performed on personal data, including collection, storage, use, disclosure or deletion. Processor: a person or entity that processes personal data on behalf of the controller.

2.3. The Controller's services are intended for business customers; the Controller does not knowingly collect data relating to persons under 16.

3 Individual processing activities

3.1. Voluntary business enquiries and email contact

Data processed: name, email address, voluntarily supplied phone number and company name, project summary and related structured business facts (such as service interest, industry, goal, problem and timing), calculated qualification, language, submission time and source page
Purpose: the requested business contact, understanding the project need, human review, responding and preparing a quotation; not newsletter subscription
Draft lawful basis: Article 6(1)(b) GDPR, as stated in the previous policy: steps at the data subject's request before entering into a contract; for corporate contacts, Article 6(1)(f): the legitimate interest in establishing a business relationship. Applicability to the new form and qualification process requires legal approval.
Retention: final deletion rules for the new submission flow, the mailbox and email provider await approval; if a contract is formed, Sections 3.2–3.3 also apply. The one-year period previously specified for general enquiries must not be treated as automatically approved for the new flow.

A corporate AI conversation does not send an email by itself. Visitors may check and correct the enquiry and then explicitly submit it using “Send to Noviram”. The server forwards the supplied contact details and concise business summary through the configured SMTP provider to Noviram's designated business email address (default: info@noviram.com). The outgoing email does not include the entire conversation log.

A live-send confirmation means the SMTP provider has accepted the message; it does not confirm arrival in the recipient's mailbox or that it has been read. The separately labelled test mode (EMAIL_MODE=mock) does not send email. Copying and opening an email application are separate, voluntary fallback options. The form is also available without using AI.

The contact fields entered separately in the form and the edited summary remain in memory while the page is open; they are not separately saved to persistent browser storage. Facts previously entered into an AI conversation may still be present in the assistant's session.

3.2. Contractual partners and their contacts

Data processed: name, position, email address and telephone number of the contracting party or its contact; communication related to performance of the contract
Purpose: concluding and performing the contract, maintaining contact and enforcing claims
Lawful basis: Article 6(1)(b) GDPR: performance of a contract where the contracting party is a natural person; Article 6(1)(f): legitimate interests for corporate contact details and enforcement of claims
Retention period: 5 years from termination of the contract (general limitation period, Section 6:22 of the Civil Code)

3.3. Invoicing

Data processed: billing name, address, tax number and mandatory invoice information
Purpose: compliance with accounting and tax obligations
Lawful basis: Article 6(1)(c) GDPR: compliance with a legal obligation (Section 169 of the VAT Act and Section 169 of the Accounting Act)
Retention period: 8 years under Section 169(2) of the Accounting Act

3.4. Newsletter

This release has no functioning newsletter delivery or subscription-recording backend. Submitting a business enquiry does not constitute marketing consent. Before a newsletter is introduced, its separate processing arrangements and any required consent must be put in place.

3.5. Website operation and server logging

Data processed: minimal application logs may include a request identifier, route, language, status code, response time, error category, AI model and usage quantities; full messages, contact details and entire conversations are not intentionally included in application logs. Rate limiting temporarily uses the connecting network address in server memory. The chosen hosting or network provider may also process separate technical access logs.
Purpose: safe and proper operation of the website, identifying errors and misuse
Draft lawful basis: Article 6(1)(f) GDPR: the legitimate interest in service security, to be reviewed against the specific logging configuration
Retention: retention, access and deletion for application and infrastructure logs must be finalised after the hosting provider is selected and before launch; the earlier general description of 30 days does not establish the settings of the new environment

3.6. Complaint handling

Data processed: the complainant's name and contact details, the content of the complaint and the response
Purpose: investigating and responding to the complaint
Lawful basis: Article 6(1)(c) GDPR: legal obligation, for consumer complaints under Section 17/A of the Consumer Protection Act (Fgytv.); otherwise Article 6(1)(f): legitimate interest
Retention period: 5 years for consumer complaints (Section 17/A(7) of the Consumer Protection Act); otherwise the applicable limitation period

3.7. Noviram AI, the corporate Project Assistant and Lead Engine demo

Using AI is voluntary. The browser sends entered messages, relevant conversation history and structured information extracted from them to Noviram's server-side API. In live AI mode, the server uses the OpenAI Responses API to interpret messages, extract project or service facts and prepare a response. Sending contact details entered separately in the form does not require a new OpenAI call; if a visitor enters such data into the AI conversation itself, it may be processed as part of the message.

Server application rules calculate the qualification score and the next suggested system action. Their purpose is to organise the business need and prepare the next useful question or human discussion. Qualification is not a contractual decision or credit assessment and does not create an entitlement to a service or appointment. Automated evaluation linked to personal data may constitute profiling; its GDPR classification and the possible need for an impact assessment require legal review. The application does not make a final decision with legal or similarly significant effects.

The embedded and floating corporate assistants share one browser session. The Lead Engine HVAC demo has a separate session: example requirements may be processed using AI, but the demo does not submit real HVAC leads, send SMS, transfer data to a CRM or book real calendar appointments. The product page's separate business contact option does not send the HVAC demo data.

OpenAI requests use store: false: the application does not request storage of responses for later retrieval through the API. This does not mean the provider retains no data at all; abuse-prevention logging and other provider processing may occur under OpenAI's terms and the actual settings of the company project. Details: OpenAI API data controls. Final verification of settings and contractual safeguards is a pre-launch task.

In the separately labelled local AI test mode, interpretation takes place without an OpenAI call. The precise lawful basis for AI processing, the roles of individual controllers and processors, and retention rules form part of the pre-launch legal review. Do not provide confidential or sensitive personal information.

3.8. Providing data is voluntary, but without the necessary contact details we cannot respond to an enquiry. For processing based on legitimate interests, a balancing assessment relating to the actual processes must be documented; this draft does not assert that it has already been completed for the new flows. Data subjects may object to processing based on legitimate interests (Article 21 GDPR).

4 Recipients and processors

4.1. Authorised Noviram personnel may access personal data to the extent necessary to handle the enquiry. The table below distinguishes implemented data flows from provider information that still requires confirmation:

Provider / status	Activity
OpenAI API The contracting legal entity, address and processor terms must be checked against Noviram's company project.	Automated interpretation of transmitted messages and context in live AI mode. Not active in local AI test mode.
SMTP and mailbox provider The specific provider has yet to be selected and recorded.	Transmission and email storage of explicitly submitted business enquiries. Email test mode does not send email.
Website and API hosting Providers for the new live environment have not yet been recorded.	Operation of the static website and server-side API; network data. The earlier Terms name GitHub, Inc.; this must be reconciled with the provider actually selected for launch.
Google Fonts	The website loads external fonts from Google's font service; this may involve a network request and transmission of the network address and technical request data. It is not added analytics or advertising tracking code.
Accounting, payroll and electronic invoicing Actual providers await confirmation.	Business administration outside the website enquiry flow, if used.

Before launch, the actual providers' legal entities, addresses, roles, contracts and retention rules must be completed. HighLevel is not integrated: this system does not transfer leads to it. No analytics, marketing tracking or real calendar integration is activated.

4.2. The Controller discloses personal data to an authority or court only in response to an official request based on law. The Controller does not transfer data to third parties for marketing or sell it.

5 Transfers to third countries

5.1. OpenAI, the font provider and the selected hosting and email providers may also process data outside the European Economic Area (EEA). Before launch, the countries and transfer mechanism under Chapter V GDPR must be documented for the new live provider arrangements. An appropriate safeguard may be an adequacy decision applicable to the recipient or standard contractual clauses (SCCs), with additional measures where necessary; this draft does not assert that either has already been verified as applicable to every provider. Information about verified safeguards may be requested at info@noviram.com.

6 Data security

6.1. This release uses server-side key handling, input validation, size and request-rate limits, a designated email recipient and data-minimised application logging. Live operation requires HTTPS, restricted access and appropriate secret management. Before launch, Noviram must verify the actual hosting, mailbox, access protection, backup and organisational measures in proportion to the risks under Article 32 GDPR.

6.2. In the event of a personal data breach, the Controller acts under Articles 33–34 GDPR: it records the breach, notifies the supervisory authority of a breach involving risk without undue delay and, where feasible, within 72 hours, and also informs affected data subjects where the breach involves high risk.

7 Data subject rights

Data subjects may exercise the following rights at any time by contacting info@noviram.com. The Controller responds without undue delay and no later than one month after receipt; where justified, this may be extended by two months with notification. Exercising rights is free of charge, except for manifestly unfounded or excessive requests.

Access (Article 15): you may ask whether your data is being processed and request a copy of the data processed.
Rectification (Article 16): you may request correction of inaccurate data and completion of incomplete data.
Erasure — the “right to be forgotten” (Article 17): you may request deletion, for example where the purpose of processing has ended, consent has been withdrawn or processing is unlawful. Erasure is not possible where processing is legally required, such as accounting retention, or necessary for legal claims.
Restriction (Article 18): you may request restriction of processing, for example while the accuracy of disputed data is being verified.
Data portability (Article 20): you may receive data processed by automated means on the basis of consent or contract in a structured, commonly used, machine-readable format, or request its transfer to another controller.
Objection (Article 21): you may object to processing based on legitimate interests at any time for reasons relating to your particular situation, and without restriction to processing for direct marketing.
Withdrawal of consent (Article 7): you may withdraw consent to consent-based processing at any time; withdrawal does not affect the lawfulness of earlier processing.

8 Remedies

8.1. As a suggested first step, data subjects may contact the Controller at info@noviram.com; the Controller investigates complaints promptly.

8.2. Data subjects may lodge a complaint with the supervisory authority:

Authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9–11.
Postal address: 1363 Budapest, Pf. 9.
Telephone: +36 (1) 391-1400
Email / website: ugyfelszolgalat@naih.hu · naih.hu

8.3. Data subjects may also bring proceedings before a court (Article 79 GDPR, Section 23 Infotv.); at the data subject's choice, proceedings may also be brought before the regional court for their domicile or place of residence.

9 Browser storage and cookies

9.1. The website code does not set analytics or marketing cookies. sessionStorage and localStorage are browser storage mechanisms, not cookies. Functional storage maintains conversation continuity and remembers the visitor's language choice.

sessionStorage: noviramCorporateAgentSession: short conversation history, structured state and a session identifier for the corporate assistant, shared by its embedded and floating interfaces. noviramLeadEngineHvacSession: state of the separate HVAC demo. Each client keeps at most 14 history entries; resetting deletes the relevant conversation. The browser associates storage with the page session; restoring a session may also restore previous data.
localStorage: noviramLang: the HU/EN language choice in the browser until the visitor overwrites it or removes it by clearing site data. It is not an advertising identifier. An explicit language parameter in the URL takes priority; browser-language detection is not used.

9.2. Visitors may clear storage in their browser's site-data settings. Browser deletion does not delete an email already explicitly sent or provider records; requests concerning those records may be submitted under Section 7. The application does not build its own persistent conversation database; temporary server-side processing, provider processing and submitted email are separate data flows.

9.3. There is no Google Analytics, Meta Pixel, Hotjar or other added analytics or advertising tracking. Before introducing such non-essential technology in future, the policy and consent arrangements must be reviewed, and any necessary consent management must be implemented before activation. This release does not add a generic cookie banner solely because AI is present.

10 The Service Provider as processor

10.1. Where the Controller operates AI systems for its clients, such as chatbots, abandoned-cart automation or customer follow-up, that process the personal data of the client's own customers or users, the controller for that processing is the client, and Noviram Digital Kft. acts as processor under Article 28 GDPR. In such cases the Parties enter into a written data processing agreement (DPA). Noviram Digital Kft. processes data only on the client's documented instructions, engages sub-processors only with the client's prior authorisation, and returns or deletes the data, at the client's choice, when the engagement ends.

11 Changes to this policy

11.1. The Controller may amend this policy, in particular following changes in law or processing practices. The policy in force is available on the website. The Controller provides prominent notice of material changes on the website and also notifies contractual partners by email.