Privacy Policy

1. Data controller

Vágó Péter János e.v. (sole trader, hereinafter: the Controller), operating this website and the digital products under it as Smart Square Productions.

• Registered address: Lejtő út 4, 1124 Budapest, Hungary
• Tax number: 41852718-1-43
• Registration number: 58098091
• E-mail: hello@smartsquareproductions.com

The Controller is not required to appoint a data protection officer and has not appointed one. All privacy requests go to the e-mail address above.

2. What we process, and why

2.1 Contact by form or email

The project form collects your name, email address, selected service and task description. You may also provide a website, preferred timing and how you found us. The submitted enquiry may include the page path, selected portfolio reference and campaign labels. Netlify Forms receives and stores form submissions. For email enquiries, we process the message and details you choose to provide. Enquiries are not automatically sent to an AI model. Source information is recorded only with the enquiry you submit, without tracking cookies or browser storage.

• Purpose: answering your enquiry, providing quotes, keeping in touch.
• Legal basis: legitimate interest and pre-contractual steps (GDPR Art. 6(1)(f) and (b)).
• Retention: correspondence for 5 years after the matter is closed; accounting records for 8 years where a contract exists.

2.2 Website operation and server logs

The website consists of static pages hosted by Netlify. The server keeps technical logs of requests, which may include IP address, timestamp, requested path and browser identifier.

• Purpose: operation, troubleshooting, abuse prevention.
• Legal basis: legitimate interest (GDPR Art. 6(1)(f)).
• Retention: according to the provider's own logging practice, typically short.

The website uses no advertising or profiling trackers. There is no Google Analytics, no advertising pixel, and no user profile is built.

Pageview measurement

The public counter measures page openings visible for at least two seconds from its displayed start date. It is a site-wide pageview count, not a count of unique people. Reloading counts as a new pageview. Known automated clients are filtered and retries of the same event are counted once. The counter stores an aggregate total and random, single-event identifiers for up to ten minutes; expired identifiers are removed on the next accepted event. It does not store IP addresses, browser fingerprints, cookies or persistent browser identifiers. The hosting service applies request rate limits. Netlify Web Analytics also provides separate server-side traffic statistics to the operator; its historical totals are not mixed into the public counter.

2.3 Web fonts

The site loads fonts from Google Fonts. Your browser connects directly to Google's servers, which may reveal your IP address to Google. Legal basis: legitimate interest in consistent, readable presentation.

2.4 Social content

The homepage displays Facebook posts as locally stored content cards. Viewing these cards does not load a Facebook embed. If you follow a link to Facebook, its own privacy rules apply there.

2.5 Blog and podcast

Reading blog posts and the podcast page requires no registration and no personal data. The podcast page may link to external video content, played under that provider's own terms.

2.6 Social media publishing (SSP Publisher)

The Controller operates an internal tool that publishes content to its own social channels: the Smart Square Productions and VProperty pages, and the Controller's own LinkedIn profile and company page.

• Data processed: access tokens issued by the social platforms, the text and image of published posts, and the time and result of publication.
• Whose data: only data belonging to the Controller's own accounts. The tool does not collect or store data about other LinkedIn or Facebook users, does not read private messages, and does not profile visitors.
• Legal basis: legitimate interest in managing the Controller's own communication (GDPR Art. 6(1)(f)).
• Security: access tokens are stored encrypted, in server-side environment variables and encrypted database fields. Tokens never appear in public code or in the browser.
• Retention: tokens until revoked or expired; the publishing log for 2 years.

You can revoke access at any time in your LinkedIn or Meta account settings.

3. Processors

The Controller uses the following services:

• Netlify, Inc. — website hosting, delivery and storage of project form submissions.
• Render Services, Inc. — running the publishing backend and its database (European region).
• Google LLC / Google Ireland Ltd. — font delivery and working file storage.
• Meta Platforms Ireland Ltd. — embedded social content, Facebook and Instagram publishing.
• LinkedIn Ireland Unlimited Company — LinkedIn publishing.
• The e-mail hosting provider — serving e-mail correspondence.

Some providers may process data outside the European Economic Area. In such cases, transfers rely on the providers' standard contractual clauses or on an adequacy decision.

4. Security

The Controller applies measures appropriate to the state of the art: encrypted connections (HTTPS), encrypted token storage, internal endpoints protected by access keys, an audit log of every publishing attempt, and the principle of least privilege.

5. Your rights

You have the right to:

• be informed and to access your data,
• rectification,
• erasure,
• restriction of processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time, where processing is based on consent.

Send your request to hello@smartsquareproductions.com. We reply within 30 days at the latest.

6. Remedies

If you believe the processing infringes your rights, you may lodge a complaint with the supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Falk Miksa utca 9–11, 1055 Budapest, Hungary
Postal address: 1363 Budapest, Pf. 9
naih.hu

You may also bring your case before the competent court at your place of residence or stay.

7. Changes to this policy

If the scope of services or the tools used change, this policy is updated too. The effective date is always shown at the top of the page.