Privacy Policy
Last updated: October 2026
This notice explains how Szalai Kevin, sole trader (Hydra Suite, the “Controller”, “we”), processes the personal data of visitors to hydrasuite.hu, of people who contact us, and of customers of the chatbot portal and the Hydra software, under Regulation (EU) 2016/679 (GDPR) and the Hungarian Information Act (Act CXII of 2011). It does not cover the data of hotel guests that a hotel handles in the Hydra software: the hotel is the controller of that data and we are its processor (see the DPA page); guests should read the hotel’s own privacy notice.
1. Controller
Name: Szalai Kevin, sole trader (egyéni vállalkozó), trading as Hydra Suite Registered address: Egry József utca 3/D 3/11, 8300 Tapolca, Hungary Sole-trader registration number: 62171962 · Tax number: 91963961-1-39 Email: info@hydrasuite.hu · Phone: +36 30 861 7345 Data protection officer: [to be completed — the appointed officer’s name and contact, or: “none appointed; not required under GDPR Art. 37”]
2. What we process, why, and on what legal basis
A) Running and securing the website Data: IP address, browser and device type, the page requested and the time (server logs). Legal basis: legitimate interest (GDPR Art. 6(1)(f)) — keeping the website running safely and protected from attacks. B) Contact and quote requests (form, email, phone) Data: name, email address, phone number, company or hotel name, the subject of interest, the message. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b)); where the enquiry is not about a contract, our legitimate interest in answering it (Art. 6(1)(f)). The website does not store the form in a database: it arrives as an email in our mailbox (delivered by Resend). C) The AI chat assistant on this website Data: the messages you type; the text of the page you have open (so the answer can draw on it); the conversation’s identifier and language; IP address and browser details; an abuse-prevention device identifier (a random identifier and a fingerprint of browser characteristics, stored only as a hash). Legal basis: legitimate interest (Art. 6(1)(f)) — answering the question you chose to ask, and protecting the service from abuse (spam, automated attacks). You start the conversation, and nothing is processed until you write; a one-line notice in the chat window, linking to this page, says so. The answers are generated by Anthropic’s AI service in the USA from your messages (see sections 4 and 5). Please don’t share sensitive personal data in the chat. D) Chatbot portal customer accounts Data: the contact person’s name, email and phone, the business name and website, the password (stored only as a bcrypt hash), the chatbot’s settings and usage statistics, sign-in data. Legal basis: performance of the contract (Art. 6(1)(b)). We send account confirmation and password reset emails (Resend). E) Billing Data: billing name, address, tax number, billing email, payment requests, invoices and bank transfer details. Legal basis: performance of the contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) — section 169 of the Hungarian Accounting Act (Act C of 2000) and the VAT Act. F) Licensing, updates and support for our software customers Data: contact persons’ names and details, the hotel or venue identifier, licence key, number and type of devices, software version, the time and IP address of licence checks, bug reports. Legal basis: performance of the contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)) — verifying licences and distributing updates securely. G) Visitor statistics (Google Analytics 4) — only with your consent Data: a pseudonymous visitor identifier (the _ga cookie), pages viewed, referring page, device and browser type, approximate location (country, city). Google Analytics 4 does not log or store the IP addresses of visitors from the EU. Legal basis: your consent (Art. 6(1)(a)), given in the cookie banner and withdrawable at any time through “Cookie settings” at the bottom of every page — as easily as it was given. Without consent, Google’s code is not even loaded. Advertising features and Google signals: [off — to be confirmed in the GA property].
3. How long we keep data
• Server logs: as long as the hosting provider keeps them, at most [30 days — to be confirmed]. • Enquiries (form, email): 12 months from the last exchange; if a contract follows, kept as contract data. Enquiries live in our mailbox, so expired ones are deleted by hand, at least every quarter. • Chat conversations: deleted automatically 31 days after the last message. Abuse-prevention records are deleted 31 days after the last event; for a lasting ban only the hashed device identifier is kept while the ban stands. • Chatbot portal account: until the contract ends; deleted within [30] days after that, except billing data. • Invoices and billing data: 8 years after the contract ends (Accounting Act, section 169). • Licence-check and device logs: 90 days; bug reports: 12 months. • Google Analytics: at Google for [14 months — the retention set in the GA property, to be confirmed]; the _ga cookie lives at most 2 years and is deleted when you withdraw consent. • Your cookie choice: 12 months, after which we ask again.
4. Who has access to the data (processors and recipients)
• Railway Corporation (USA) — hosting of the website, the chatbot portal and the Hydra Admin backend; the data sits in an EU-region data centre. • Resend, Inc. (USA) — email delivery (contact form, account and password emails), in its EU region. • Anthropic PBC (USA) — generating the chat assistant’s answers from the messages typed. • Google Ireland Ltd. and Google LLC — Google Analytics, only with your consent. • Cloudflare, Inc. (R2 storage) — serves the website’s images; sees your IP address when your browser downloads them. No personal data is stored there. • Vercel Inc. (USA) — hosting of the static version of the marketing pages, where the site is served from there. • Mailbox provider for hydrasuite.hu: [to be completed]. • Our accountant: [name, address — to be completed] (billing data). Our bank (transfers) and the Hungarian Tax Authority, NAV (invoice data reporting), receive data under the law, as independent controllers. The website does not use Sentry error tracking. We do not sell data or pass it to anyone for advertising.
5. Transfers outside the EU
• Anthropic (USA): if you use the chat, your messages reach a US provider. The transfer relies on the standard contractual clauses (SCCs, GDPR Art. 46) in Anthropic’s data processing terms. [To be confirmed whether Anthropic is certified under the EU–US Data Privacy Framework (DPF).] US rules on government access differ from EU rules. • Google LLC (USA): the adequacy decision for the EU–US Data Privacy Framework (DPF, GDPR Art. 45), only with your consent. • Railway, Resend, Cloudflare: US companies; the data is stored in EU regions. All three are certified under the EU–US Data Privacy Framework (DPF), and their data processing agreements also contain the standard contractual clauses (SCCs) as a fallback. • Vercel (USA): DPF or SCCs [to be confirmed].
6. Your rights and remedies
You may ask us to tell you how we process your data and give you a copy (access), correct it (rectification), erase it or restrict its processing, or hand it over in a machine-readable format (portability). You may object to processing based on legitimate interest, and withdraw your consent at any time; withdrawal does not affect the lawfulness of processing before it. Send requests to info@hydrasuite.hu; we answer within one month at the latest. You may complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): Falk Miksa utca 9–11, 1055 Budapest · postal address: 1363 Budapest, Pf. 9. · phone: +36 1 391 1400 · ugyfelszolgalat@naih.hu · https://naih.hu. You may also go to court; you can bring the case before the regional court (törvényszék) of your home or residence.
7. Cookies and data stored in your browser
Google Analytics cookies are set only if you choose “Accept” in the cookie banner. Everything else below is strictly necessary for the website or for a feature you asked for (language, sign-in, chat), so it needs no consent. You can change your choice at any time with “Cookie settings” at the bottom of the page. The live demos embedded in the product pages (booking engine, spa) keep the language and your selections in your browser’s local storage (localStorage).
| Name | Purpose | Duration | Consent needed? |
|---|---|---|---|
| hydra_consent (localStorage) | Your cookie choice and when you made it | 12 months | No |
| NEXT_LOCALE | The language you chose | Until the browser is closed | No |
| hydra_chat_token | Sign-in to the chatbot portal (customers only) | 3 days (“remember me”: 30 days) | No |
| hydra-chat-…, hydra-chat-lang-…, hydra-cooldown-… (localStorage) | Chat: the conversation’s identifier, the chosen language, any temporary block | Until you clear it; the server deletes the conversation after 31 days | No |
| hydra_dev (cookie), hydra-dev-ls (localStorage) | Chat: abuse-prevention device identifier, created when you send your first message | 1 year | No |
| hydra_admin_session | Sign-in to the internal admin (staff only) | 8 hours | No |
| _ga | Google Analytics: tells visitors apart | 2 years | Yes |
| _ga_XXXXXXXXXX | Google Analytics: session state | 2 years | Yes |