Data protection
Privacy notice
Effective 22 July 2026 · Version 1.1
1. Controller
| Name | Tápió Építő Kft. |
|---|---|
| Seat | 2600 Vác, Borvirág utca 10/a., Hungary |
| Registration | 13-09-066445 |
| VAT | 10815740-2-13 |
| Contact | adatkezeles@siteenergy.hu |
No data protection officer has been appointed; under Article 37 GDPR we are not required to designate one.
2. This website
Browsing alone involves no data collection. There are no cookies, no analytics and no embedded third-party content. Fonts are served from our own server rather than a font CDN, so your browser contacts no third party during your visit.
The site has one form: the order form. If you do not submit it, we process no data about you.
2.1 The order form
| Data | company name, tax number, EU VAT number (if given), registered address, contact person's name, e-mail address, phone (optional), note; the chosen plan and billing period; the version of the Terms accepted and the time of acceptance; the truncated IP address of the submission (last octet zeroed) |
|---|---|
| Purpose | processing the order: confirmation, pro-forma invoice and invoice, creating the access |
| Basis | steps prior to entering into a contract at your request, and performance of that contract (Art. 6(1)(b) GDPR). Storing the truncated IP address rests on legitimate interest (Art. 6(1)(f)) — filtering out abusive, automated submissions |
| Retention | if the order becomes a contract: data attached to accounting records is kept for 8 years under Hungarian accounting law. If no contract is formed (withdrawn or declined order): at most 1 year, then deletion |
We record the version of the Terms and the time of acceptance because section 3.3 of the Terms requires it — so it remains verifiable which text a customer accepted.
The order form does not ask for card details, and the system never handles them: payment is by bank transfer.
If you email us, we process the details in that correspondence (name, email address, message) in order to answer you, on the basis of legitimate interest, and keep it for at most one year after the matter is closed.
The web server keeps an operational log (timestamp, truncated IP address, requested page) for security and troubleshooting, retained for at most 90 days.
3. The SiteEnergy service
The service is available at app.siteenergy.hu. The processing below concerns subscribers and their users.
3.1 Account and sign-in
Data: e-mail address (this is the sign-in name), a cryptographic hash of the password (we neither know the password nor can recover it), name and company, plan, expiry date, last sign-in. Signing in creates a session: your browser receives a technical cookie, and we store the session's truncated IP address and browser identifier so you can recognise your own devices.
Basis: performance of a contract (Art. 6(1)(b) GDPR). The session cookie is strictly necessary for the service to work, so consent is not required — information is, and this is it. Retention: the account is deleted according to section 13 of the Terms after the subscription ends; sessions expire by themselves after 30 days of inactivity.
3.2 Billing
Data: the billing details under 2.1 (company name, registered address, tax number), the content of the order, the pro-forma invoice and invoice issued. Basis: legal obligation (Art. 6(1)(c) GDPR). Retention: eight years under Hungarian accounting law.
3.3 Audit log
The system logs significant user actions: sign-in, failed sign-in, site creation, file upload, data generation, calculation, printing, export, and the fact that an order arrived from the website.
What is recorded: timestamp, truncated IP address (last octet zeroed), pseudonymous user identifier, plan, event type and a few quantitative details.
What is deliberately NOT recorded: client names, addresses, coordinates, uploaded file names or contents, measured values, calculation results, passwords. On a failed sign-in the rejected password is not logged either. For an order, only the fact, the plan and the identifier are logged — never the company name or e-mail address. The log is neither suitable nor permitted for employee performance monitoring.
Basis: legitimate interest (Art. 6(1)(f) GDPR) — operational security, troubleshooting, detection of misuse. Retention: 90 days, then automatic deletion.
3.4 Data uploaded by the user
For data entered into the software — client names, addresses, consumption time series — the user (or their employer) is the controller and Tápió Építő Kft. acts as processor. We process such data solely to provide the service, on the user's instructions, under a data processing agreement.
3.5 AI integration (connecting your own AI subscription)
New item — effective 1 September 2026
A subscriber on the highest (Complex) plan may connect their own third-party AI subscription (e.g. Anthropic Claude, OpenAI ChatGPT, Perplexity, Google Gemini) to their account; the AI produces analysis and report drafts from their own data. The subscriber initiates this and can turn it off at any time.
| Data processed | Aggregates computed from the account's energy, asset, consumption/generation, tariff and emissions data (read-only). The uploaded raw hourly meter rows are NOT transmitted. |
|---|---|
| Purpose | subscriber-initiated AI-based analysis and report drafts |
| Legal basis | consent (GDPR Art. 6(1)(a)) and/or performance of the contract (Art. 6(1)(b)) |
| Recipient | the AI provider chosen by the subscriber; in this relationship the AI provider is the subscriber's processor, not ours |
| Third country | some providers may process data outside the EU (e.g. USA); safeguards per the provider's terms |
| Retention | no new persistent storage on our side; the access token is account-bound and revocable anytime |
Data minimisation & security: aggregated values only, read-only access, tenant isolation, OAuth 2.1 + PKCE, audit log, rate limiting. Consent can be withdrawn anytime; this does not affect the lawfulness of processing before withdrawal.
4. Newsletter
Purpose: sending a newsletter about SiteEnergy news, updates and regulatory changes affecting the service.
Legal basis: your consent (GDPR Article 6(1)(a)). Giving consent is voluntary and is not a condition of entering into a contract or using the service.
Data processed: email address, chosen language, source of the subscription (website or order form), the time of subscription and confirmation, and the IP address at subscription in anonymised form (without the last octet). We store the time and the IP because under GDPR Article 7(1) we must be able to demonstrate that consent was given.
Double opt-in: a subscription only becomes valid when you open the link sent by email. Without confirmation we send no newsletter and delete the address after 7 days.
Retention: until you withdraw consent. After unsubscribing we do not delete the address immediately but keep it on a suppression list — this proves we honoured your request and prevents the address from being re-added by accident. You may request deletion from the suppression list.
Withdrawal: consent can be withdrawn at any time, without giving a reason and free of charge. Every newsletter contains an unsubscribe link; withdrawal can also be requested at info@siteenergy.hu. Withdrawal does not affect the lawfulness of processing before the withdrawal.
Recipients and transfers: the newsletter list is handled in our own system; addresses are not shared with third parties and are not transferred outside the EEA. No automated decision-making or profiling takes place.
5. Processors
| Provider | Role | Location |
|---|---|---|
| RackForest Kft. | hosting (website, application) | Hungary |
| Zoho | email (storage of messages sent to us) | EU — Zoho's European data centre |
Fees are paid by bank transfer, so we use no payment provider: we neither handle nor ask for card details. Billing data is processed to meet our accounting obligations. Should we introduce a payment or invoicing system later, we will update this list.
6. Your rights
You may request access to your data, its rectification or erasure, restriction of processing and data portability, and you may object to processing based on legitimate interest — including the audit log.
Write to adatkezeles@siteenergy.hu or to our registered seat. We respond within one month; in complex cases this may be extended by two months, of which we will inform you. There is no charge.
7. Remedies
You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):
| Address | 1055 Budapest, Falk Miksa utca 9–11., Hungary |
|---|---|
| Postal | 1363 Budapest, Pf.: 9. |
| ugyfelszolgalat@naih.hu | |
| Phone | +36 (1) 391-1400 |
| Web | naih.hu |
You may also bring the matter before a court, including the tribunal competent for your place of residence. Such proceedings are exempt from court fees in Hungary.
8. Changes
We review this notice annually and whenever processing changes materially — in particular at the launch of the service, when new categories of data and new processors come into scope. Users will be notified in advance.