Privacy Policy

Last updated: 28 July 2026
Effective from: 28 July 2026

This Privacy Policy explains how Indiekube Kft. ("indiekube", "we", "us") collects, uses, shares and protects personal data when you visit indiekube.io or contact us. We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information (the "Privacy Act").

---

1. Who is responsible for your data

The data controller is:

Company name	Indiekube Kft. (Indiekube Fejlesztő, Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság)
Registered seat	Óvoda utca 2., 8274 Köveskál, Hungary
Company registration number	19-09-521804
Tax number	29134100-2-19
Represented by	Ákos Mocsányi, Managing Director
Email	info [at] indiekube [dot] io
Other contact	Via our contact form, or in writing to our registered seat above
Website	https://indiekube.io/

Data Protection Officer. Given the nature, scope and purposes of our processing, we are not required to appoint a Data Protection Officer under Article 37 GDPR, and we have not appointed one voluntarily. Please direct all privacy enquiries to info [at] indiekube [dot] io, marking your message for the attention of data protection. You may also use our contact form or write to our registered seat.

---

2. What data we process, why, and on what legal basis

We only process personal data where we have a lawful basis to do so. The table below is a complete description of the processing carried out through this website.

2.1 Contact form enquiries

Data processed	Your name, email address, the content of your message, and the date and time of submission. We do not record or store your IP address with your enquiry.
Purpose	To receive, review and reply to your enquiry, and to discuss a possible business relationship.
Legal basis	Article 6(1)(b) GDPR — steps taken at your request prior to entering into a contract, where your enquiry concerns our services; and Article 6(1)(f) GDPR — our legitimate interest in responding to business communications addressed to us and in protecting the form against abuse.
Retention	Two (2) years from our last correspondence with you, after which the message is deleted. If a contract results from your enquiry, the related records are kept for the statutory periods described in section 4.
Consequence of not providing	Providing this data is voluntary, but without a name, email address and message we cannot process or answer your enquiry.

2.2 Spam and bot protection (Cloudflare Turnstile)

Data processed	IP address, browser and device characteristics, and signals about how the page is interacted with, collected by the Cloudflare Turnstile widget embedded on our contact page. When your submission is validated, your IP address is transmitted to Cloudflare for that check only; it is not retained by us afterwards.
Purpose	To distinguish human visitors from automated systems and prevent abusive or automated submissions of our contact form.
Legal basis	Article 6(1)(f) GDPR — our legitimate interest in maintaining the security, availability and integrity of our website and in preventing spam and abuse.
Retention	Validation tokens are short-lived and are not stored by us. Cloudflare retains the underlying data according to its own retention schedule.
Note	Turnstile is a privacy-preserving alternative to conventional CAPTCHAs: it does not use data collected on our site to build advertising profiles.

2.3 Server and security logs (website hosting)

Data processed	IP address, date and time of the request, the URL requested, HTTP status code, referring page, user agent (browser and operating system) and approximate country of origin.
Purpose	To deliver the website to your device, ensure its stability and security, detect and mitigate attacks, and diagnose technical faults.
Legal basis	Article 6(1)(f) GDPR — our legitimate interest in operating a secure, functioning website.
Retention	Log data is retained by our hosting provider for a short, rolling period (typically no more than 30 days) and is then automatically deleted or aggregated.

2.4 Direct email correspondence

Data processed	Your email address, name, signature details and any information you choose to include in your message.
Purpose	To communicate with you and manage our business relationship.
Legal basis	Article 6(1)(b) or 6(1)(f) GDPR, as applicable, as described in section 2.1.
Retention	Two (2) years from our last correspondence, unless a longer statutory period applies.

2.5 What we do not do

• We do not use analytics, advertising, retargeting or social media tracking technologies.
• We do not sell, rent or trade personal data.
• We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR).
• We do not knowingly collect special categories of personal data (Article 9 GDPR) or data relating to criminal convictions.
• Our website and services are not directed at children under the age of 16, and we do not knowingly collect their data.
• We do not send marketing newsletters from this website.

---

3. Cookies and similar technologies

This website does not set analytics, advertising or tracking cookies, and therefore does not display a cookie consent banner. The only client-side storage that may occur is strictly necessary for the security functions described in section 2.2, which is exempt from the consent requirement under Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive) and Section 155(4) of Hungarian Act C of 2003 on Electronic Communications.

See our Cookie Notice for the full detail.

---

4. Who receives your data

We do not share personal data with third parties other than the service providers ("processors") listed below, who process data solely on our documented instructions under a data processing agreement compliant with Article 28 GDPR.

No third-party content delivery networks. All fonts, stylesheets and scripts used by this website are served from our own domain. Your browser does not contact any external CDN or other third-party host when you load our pages, so no IP address or browsing data is disclosed to such parties.

We may also disclose personal data to our accountants, auditors and legal advisers where necessary, and to public authorities where we are legally obliged to do so (Article 6(1)(c) GDPR).

Statutory retention. Where a contract is concluded, documents supporting accounting entries must be retained for eight (8) years under Section 169 of Hungarian Act C of 2000 on Accounting, and invoicing data for the periods required by tax legislation.

---

5. International data transfers

Our email is contracted with Google Ireland Limited, an entity established in the European Economic Area, and Google Workspace data for European customers is held primarily on infrastructure in the EEA. Google may nonetheless involve affiliates outside the EEA — including Google LLC in the United States — for support and sub-processing.

Our other processors, Cloudflare and Resend, are established in or operate infrastructure in the United States, a country outside the European Economic Area. Transfers of personal data to any of these providers are safeguarded under Chapter V GDPR by:

• the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), incorporated into our data processing agreements; and/or
• the recipient's certification under the EU–U.S. Data Privacy Framework, in respect of which the European Commission has issued an adequacy decision.

You may request a copy of the relevant safeguards by writing to info [at] indiekube [dot] io.

---

6. How we protect your data

We implement appropriate technical and organisational measures under Article 32 GDPR, taking into account the state of the art, implementation costs and the risks to your rights and freedoms. These include:

• encryption of all traffic in transit using TLS (HTTPS);
• encryption of data at rest by our infrastructure providers;
• access to personal data restricted to personnel who need it, under confidentiality obligations;
• API credentials and secrets stored in a managed secret store, never in source code;
• bot and abuse protection on all public forms;
• data minimisation — we ask only for what we need to answer you.

No method of transmission or storage is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Hungarian National Authority for Data Protection and Freedom of Information within 72 hours as required by Article 33 GDPR, and will inform you directly where Article 34 GDPR requires it.

---

7. Your rights

Under the GDPR you have the following rights in relation to your personal data:

• Right of access (Article 15) — to obtain confirmation of whether we process your data, and a copy of it.
• Right to rectification (Article 16) — to have inaccurate data corrected and incomplete data completed.
• Right to erasure (Article 17) — to have your data deleted where one of the grounds in the GDPR applies.
• Right to restriction of processing (Article 18) — to have processing limited in defined circumstances.
• Right to data portability (Article 20) — to receive data you provided to us in a structured, commonly used, machine-readable format, where processing is based on consent or contract and carried out by automated means.
• Right to object (Article 21) — to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. We will stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.
• Right to withdraw consent (Article 7(3)) — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand.
• Right not to be subject to automated decision-making (Article 22) — we do not carry out such processing.

How to exercise your rights

Write to info [at] indiekube [dot] io, submit your request through our contact form, or write to our registered seat. We will respond without undue delay and in any event within one month of receiving your request. That period may be extended by up to two further months where necessary, taking into account the complexity and number of requests; we will inform you of any extension and the reasons for it. Exercising these rights is free of charge, unless a request is manifestly unfounded or excessive. We may ask for information reasonably needed to confirm your identity before acting.

---

8. Complaints and remedies

If you believe our processing of your personal data infringes the GDPR, we would appreciate the chance to resolve it first — please tell us at info [at] indiekube [dot] io.

You also have the right to lodge a complaint with a supervisory authority. The competent authority in Hungary is:

Authority	Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) Hungarian National Authority for Data Protection and Freedom of Information
Address	H-1055 Budapest, Falk Miksa utca 9-11., Hungary
Postal address	H-1363 Budapest, Pf. 9.
Phone	+36 (1) 391-1400
Email	[email protected]
Website	https://naih.hu/

If you are resident in another EEA country, you may also complain to the supervisory authority of your habitual residence or place of work. Independently of any complaint, you may seek a judicial remedy before the competent Hungarian court — proceedings may be brought before the tribunal (törvényszék) of your place of residence or stay.

---

9. Changes to this policy

We may update this Privacy Policy to reflect changes to our services, our processors or applicable law. The "Last updated" date at the top of this page always shows the current version. Where a change materially affects how we handle your personal data, we will take reasonable steps to bring it to your attention.

---

10. Contact

Questions about this policy or our handling of personal data:
Indiekube Kft.
Óvoda utca 2., 8274 Köveskál, Hungary
Email: info [at] indiekube [dot] io
Or use our contact form.

See also our Cookie Notice and Legal Notice.