Privacy Policy
Privacy policy for the naxoft.com website and the services provided by ChronoGo Kft.
Effective: 2026.01.01.
1. Data Controller Identification
2. Scope and Purpose of This Policy
2.1. This Privacy Policy applies to the processing of personal data in connection with the use of the naxoft.com website, consultation booking, contact requests, and the B2B services provided by the Data Controller (AI-based digital automation; enterprise internal AI chat; AI models with API access).
2.2. This Policy covers the personal data of data subjects (in particular, contact persons of Clients, employees/users of the Client, and prospective clients).
2.3. In the course of providing services, the Data Controller may act as either a data controller or a data processor, depending on the nature of the data processing. In a service environment, the Client typically qualifies as the data controller and the Data Controller acts as a data processor; the detailed terms are set out in a separate agreement (contract/DPA) between the parties.
3. Legal Bases for Data Processing — General Principles
3.1. The Data Controller processes personal data exclusively on the basis of one of the legal grounds set out in Article 6(1) of the GDPR.
3.2. The Data Controller processes personal data in accordance with the principle of purpose limitation, exclusively for specified, explicit, and legitimate purposes, and does not process them in a manner incompatible with those purposes.
3.3. The Data Controller applies appropriate technical and organizational measures to ensure the security of personal data.
4. Details of Data Processing (Purpose, Legal Basis, Data Categories)
4.1. Website Use (Technical Operation, Security)
IP address, browser and device information, logged technical events, technical data related to website usage, and other data.
Website operation, IT security, incident management, prevention of abuse.
Legitimate interest of the Data Controller (Article 6(1)(f) GDPR).
Where cookies and similar technologies are used, the detailed rules are set out in a separate Cookie Policy.
4.2. Contact Requests (Email)
Name, company name, job title, email address, phone number, message content, related metadata, and other data.
Business contact, provision of information, coordination, preliminary needs assessment, preparation of offer/contract process.
Steps taken prior to entering into a contract (Article 6(1)(b) GDPR) and/or legitimate interest of the Data Controller (Article 6(1)(f) GDPR).
4.3. Consultation Booking
Name, email address, phone number, company name, booking details, technical data processed by the booking system, and other data.
Scheduling and conducting consultation appointments, maintaining contact.
Steps taken prior to entering into a contract (Article 6(1)(b) GDPR) and/or legitimate interest (Article 6(1)(f) GDPR).
4.4. Contracting and Contract Performance (B2B)
Names, job titles, email addresses, and phone numbers of Client contact persons; contractual and billing data; communication related to performance, and other data.
Contract creation, performance, contact maintenance, invoicing, claims management, enforcement of legal claims.
Performance of a contract / steps taken prior to entering into a contract (Article 6(1)(b) GDPR); legal obligation (Article 6(1)(c) GDPR) — in particular, fulfillment of accounting obligations.
4.5. Data Processed in the Course of Providing Services (Data Processor Role)
AI-based automation, enterprise AI chat, API access, and other services.
Data entered, uploaded, integrated, or generated by the Client in the course of the services; such data may include personal data.
Provision of the service in accordance with the Client's instructions.
In the case of data processing, the legal basis for data processing is determined by the Client as the data controller. The Data Controller acts on the basis of the Client's documented instructions.
The detailed terms are governed by the parties' contract and — where applicable — a data processing agreement (DPA).
4.6. Operations, Logging, Debugging, Auditability
User identifiers (if applicable), authorization data, system and security logs (e.g., login and error information, operational logs), technical metadata, and other data.
Secure operation, error detection, error resolution, prevention of abuse, support for compliance and audit requirements.
Legitimate interest (Article 6(1)(f) GDPR).
12–24 months.
4.7. Marketing and Business Development Communications
The Data Controller is entitled to use contact data provided by the data subject to send business and marketing emails, including information about services, consultation opportunities, feature updates, events, and content supporting collaboration.
Legitimate interest of the Data Controller (Article 6(1)(f) GDPR), related to maintaining and developing business relationships and delivering relevant information about services.
The data subject may object to such communications at any time; upon objection, the Data Controller will cease sending further marketing/business development messages. Methods for objecting and unsubscribing: (i) via the unsubscribe option included in the email, and/or (ii) by sending a request to info@naxoftai.com.
4.8. Cookies, Tracking Codes, and Similar Technologies
The Data Controller may use cookies, tracking codes, pixels, and other technologies for measuring website usage and evaluating the effectiveness of marketing communications, in order to operate, develop, and improve the user experience of the naxoft.com website.
Ensuring the basic operation and security of the website; preparing traffic and usage statistics (analytics); monitoring website performance and errors; measuring marketing campaign performance, targeting and retargeting (remarketing), where such features are implemented.
IP address, device and browser data, actions performed on the site (e.g., page views, clicks), identifiers (cookie ID), advertising identifiers, and event data related to website usage.
Cookies and technologies strictly necessary for the operation of the website may be based on the Data Controller's legitimate interest (Article 6(1)(f) GDPR). Non-essential cookies and similar technologies (in particular: analytics, marketing, remarketing) require the data subject's consent, which the Data Controller obtains through the cookie/consent management interface (cookie banner) displayed on the website. Consent may be withdrawn at any time, which shall not affect the lawfulness of processing carried out prior to the withdrawal.
A detailed description of cookies and similar technologies (categories, purposes, providers, retention periods, possible data transfers) is published by the Data Controller in a separate Cookie Policy; visitors may also modify their settings at any time via the cookie banner.
Where the Data Controller uses third-party analytics or advertising services, the identity of the providers, any data transfers outside the EU/EEA, and the safeguards applied are specified in the Cookie Policy.
5. Use of Client Data for Model Development
5.1. The Data Controller does not use Client data for the development, training, or improvement of its own general-purpose AI models.
5.2. Client-specific training/fine-tuning may only be carried out under a separate agreement and documented client request, for the benefit of the specific Client; in such cases, the parties separately define the applicable data protection and contractual framework (in particular the DPA, data categories, retention periods, and security measures).
6. Data Residency, Data Transfers
6.1. The Data Controller operates its services on its own servers in the EU; accordingly, data storage and processing take place within the European Union as a general rule.
6.2. Data transfers to third countries (outside the EU/EEA) — where certain subcontractors or tools require it — may only take place with appropriate safeguards under the GDPR (e.g., standard contractual clauses).
7. Data Processors, Recipients
7.1. The Data Controller may engage data processors for the provision of services (e.g., booking system, email service, hosting-related service providers).
7.2. Personal data may be transferred to authorities or courts on the basis of a legal obligation.
8. Data Retention Period
The Data Controller processes personal data only for as long as necessary to achieve the purpose, taking into account legal obligations and limitation periods for claims. Indicative retention periods:
- Contact requests: 5 years
- Booking data: 5 years
- Contractual documentation and communication: 5 years
- Accounting records: in accordance with the applicable statutory retention period
- Security and operational logs: 5 years
Where the retention periods are defined differently in a contract with the given Client, the provisions of that contract shall apply.
9. Rights of Data Subjects and How to Exercise Them
9.1. The data subject has the right to:
- Request information about the processing of their personal data (access)
- Request rectification of their data
- Request erasure of their data (where the legal conditions are met)
- Request restriction of processing
- Object to processing based on legitimate interest
9.2. Requests may be submitted at info@naxoftai.com. The Data Controller shall respond to requests without undue delay and in any event within the deadline set by the GDPR.
9.3. Where data is processed in a data processor capacity, data subject requests are handled in cooperation with the Client (data controller), in accordance with the DPA.
10. Complaints, Legal Remedies
10.1. The data subject may file a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).
10.2. The data subject may also seek judicial remedy in the event of a violation of their rights under the GDPR.
11. Automated Decision-Making and Profiling
11.1. In the course of operating the website, the Data Controller does not employ automated decision-making that produces legal effects concerning the data subject or similarly significantly affects them.
11.2. Outputs provided by the enterprise AI chat and AI services are informational in nature; the Client is responsible for decisions made based on those outputs.
12. Amendments to This Policy
The Data Controller is entitled to unilaterally amend this Privacy Policy. Amendments shall take effect upon publication on the naxoft.com website.