HUNGARY-FOCUSED DEFENCE & DUAL-USE ENGINEERING SUPPORT
1. Who We Are
The controller responsible for the processing described in this Notice is:
Horváth Ákos, sole proprietor, trading as NERQALIS
Registered office: 1097 Budapest, Pápay István u. 5., Hungary
Sole proprietor registration no.: 62335256
Hungarian tax no.: 52495177-1-43
EU VAT no.: HU52495177
Email for privacy enquiries and data-subject requests: contact@nerqalis.com
In this Notice, “NERQALIS,” “we,” “us” and “our” refer to the controller identified above.
2. Scope of This Notice
This Notice explains how NERQALIS processes personal data in connection with:
- the operation, delivery and security of nerqalis.com;
- business enquiries and pre-contractual communications;
- client engagements and project administration;
- professional and business contacts;
- business email and related service providers; and
- cookies and similar technologies used by the website.
The website is intended primarily for professional and business users and provides information about NERQALIS and its defence and dual-use project, engineering and technical-support capabilities.
This Notice applies where NERQALIS acts as a controller. Section 11 explains the position where NERQALIS processes personal data on behalf of a client as a processor.
3. How We Process Personal Data
3.1 Website Operation, Delivery and Security
| Item | Details |
|---|---|
| Data categories | IP address; request and connection metadata; browser and device information; technical identifiers; and website, network and security logs. |
| Purposes | Delivering the website; maintaining its availability and technical operation; routing network traffic; protecting the website and associated infrastructure; preventing, detecting and investigating abuse, malicious traffic and security events; and resolving technical problems. |
| Legal basis | Article 6(1)(f) GDPR. NERQALIS has a legitimate interest in making its website available, maintaining reliable operations, protecting its systems and users, and investigating security incidents or misuse. |
| Recipients and service providers | Cloudflare provides domain and DNS services, Cloudflare Workers hosting, content delivery, traffic management and network-security infrastructure. Data may also be disclosed to competent authorities or professional advisers where necessary and legally justified. |
| Retention | Technical and security data are retained only for as long as required for website delivery, security, abuse prevention, incident investigation and the operation of the relevant Cloudflare service. The applicable period may depend on the type of record, the enabled service and its configuration. Data required for an unresolved security incident or legal claim may be retained until the matter is resolved and any applicable claim period has expired. |
3.2 Business Enquiries and Pre-Contractual Communications
| Item | Details |
|---|---|
| Data categories | Name; professional contact details; employer or organisation; job title or professional role; enquiry and correspondence content; project-related information voluntarily provided; meeting arrangements; and related communication records. |
| Purposes | Responding to enquiries; communicating about NERQALIS services; understanding business and technical requirements; arranging discussions; assessing a proposed engagement; preparing an offer or other pre-contractual documentation; and maintaining a record of the enquiry. |
| Legal basis | Where an individual asks NERQALIS to take steps before entering into a contract, processing necessary for those steps is based on Article 6(1)(b) GDPR. Where the individual communicates on behalf of an organisation, or the requested processing is not necessary for a contract with that individual, processing is based on Article 6(1)(f) GDPR. NERQALIS has a legitimate interest in receiving and responding to relevant B2B enquiries, assessing potential engagements and communicating with prospective clients, suppliers and professional partners. |
| Recipients and service providers | Zoho Mail processes business emails, contact details and attachments sent to or from NERQALIS. Information may also be disclosed, where necessary, to professional advisers, prospective project participants or competent authorities, subject to an appropriate legal basis and confidentiality or legal safeguards. |
| Retention | Enquiry records are generally retained for up to 24 months after the last substantive communication. If the enquiry results in an engagement, relevant information becomes part of the applicable client or project records. Information may be retained for longer where necessary to meet a legal or compliance obligation or to establish, exercise or defend legal claims. |
3.3 Client Engagements and Project Administration
| Item | Details |
|---|---|
| Data categories | Professional contact details; organisational and role information; correspondence; meeting records; instructions and approvals; contractual records; billing and payment-related information; compliance information; and personal data contained in project documentation, deliverables or technical records where relevant to the engagement. |
| Purposes | Entering into and performing engagements; delivering agreed services; communicating with clients and project participants; managing scope, schedules, meetings and deliverables; maintaining project records; invoicing and accounting; meeting legal, regulatory, contractual, security, export-control and compliance requirements; administering the business; and establishing, exercising or defending legal claims. |
| Legal basis: contract | Processing necessary to perform a contract with an individual or take requested pre-contractual steps is based on Article 6(1)(b) GDPR. |
| Legal basis: legal obligations | Processing required by accounting, tax or other applicable laws is based on Article 6(1)(c) GDPR. |
| Legal basis: legitimate interests | Processing relating to client representatives, project participants, project administration, business records and legal claims is based on Article 6(1)(f) GDPR where applicable. NERQALIS has legitimate interests in performing and documenting engagements, coordinating with client personnel and other project participants, managing its business, protecting its legal position and handling disputes or claims. |
| Recipients and service providers | Depending on the engagement, information may be disclosed to the relevant client, authorised project participants, project subcontractors, professional advisers, service providers or competent authorities. Disclosures are limited to what is necessary and are subject to an appropriate legal basis and applicable confidentiality, contractual or legal safeguards. |
| Storage | Project files are ordinarily stored locally on NERQALIS business devices. NERQALIS does not currently use a general-purpose cloud file-storage service for project files. If project documents or attachments are sent or received by email, copies may also be processed and stored in Zoho Mail. |
| Retention | Active project records are retained for the duration of the engagement. After completion, contractual and project-administration records are retained for as long as reasonably necessary to document performance, meet contractual or compliance requirements, manage applicable limitation periods and establish, exercise or defend legal claims. Accounting documents are retained for the statutory period, generally eight years where Hungarian accounting rules apply. Records subject to regulatory, export-control, security or other compliance requirements are retained according to the relevant obligation and the nature of the project. Records are deleted or anonymised when they are no longer required for the applicable purpose, legal obligation or claim. |
3.4 Professional and Business Contacts
| Item | Details |
|---|---|
| Data categories | Name; professional contact details; employer or organisation; position or professional role; area of responsibility; source of the contact; and records of relevant professional communications. |
| Sources | Data may be obtained directly from the individual or through referrals, professional events, business cards, corporate websites, LinkedIn or other legitimate public professional sources. |
| Purposes | Establishing, maintaining and managing relevant professional and B2B relationships; identifying appropriate organisational contacts; and communicating about matters relevant to NERQALIS’s business. |
| Legal basis | Article 6(1)(f) GDPR. NERQALIS has a legitimate interest in maintaining a proportionate network of relevant business and professional contacts and communicating with individuals in their professional capacity. |
| Recipients and service providers | Zoho Mail may process professional contact details and related correspondence. Information may also be shared internally with persons involved in the relevant business relationship and, where necessary, with professional advisers or authorised project participants. |
| Retention | Professional contact information is retained while the relationship or legitimate business relevance continues and is periodically reviewed. It is deleted when no longer necessary, unless retention remains necessary under applicable law or for legal claims. |
A GDPR legal basis does not, by itself, authorise unsolicited electronic marketing. Before sending direct electronic marketing, NERQALIS separately assesses the communications, consent and marketing rules applicable to the intended message and recipient.
3.5 Information Obtained Indirectly
Where professional contact information is not obtained directly from the individual, NERQALIS provides the information required by Article 14 GDPR within the applicable period. Depending on the circumstances, this will generally be:
- within a reasonable period after obtaining the data and no later than one month;
- at the time of the first communication with the individual, if communication occurs earlier; or
- before the first disclosure to another recipient, if disclosure is intended and occurs earlier.
This information is provided unless a GDPR exception applies, including where the individual already has the relevant information.
4. Service Providers and External Platforms
4.1 Cloudflare
Cloudflare provides infrastructure used for:
- domain and DNS operation;
- Cloudflare Workers website hosting;
- content delivery;
- traffic and request handling; and
- network and website security.
When providing these services, Cloudflare may process IP addresses, website requests, connection metadata, technical information and security-related records.
NERQALIS relies on the Cloudflare contractual data-protection terms and international-transfer safeguards applicable to the services and account configuration in use.
4.2 Zoho Mail
NERQALIS uses Zoho Mail for business email. Emails, sender and recipient details, contact information, message content and attachments sent to or from NERQALIS may therefore be processed and stored in Zoho’s systems.
NERQALIS has completed the relevant Zoho Data Processing Addendum process. Zoho Mail is not used as a general-purpose cloud file-storage service for project files, although copies of files may be present in email messages and attachments.
4.3 Google Search Console
NERQALIS uses Google Search Console for:
- website ownership verification;
- indexing and search-presence management; and
- access to search-performance information through the Search Console account.
Google Search Console is not embedded in nerqalis.com as an analytics or marketing tracker. Its use does not mean that Google Analytics, Google Tag Manager or Google advertising tags are loaded through the website.
Google processes information relating to the Search Console service under the terms applicable to that service. NERQALIS does not use Search Console to carry out behavioural advertising or visitor profiling on nerqalis.com.
4.4 LinkedIn
The website contains ordinary links to:
- the NERQALIS LinkedIn Company Page; and
- LinkedIn profiles of consultants.
NERQALIS does not currently embed a LinkedIn feed, iframe, plugin, badge or LinkedIn Insight Tag in the website.
No information is transmitted to LinkedIn merely because an ordinary text link appears on a page. If a visitor chooses to follow a LinkedIn link, the visitor leaves nerqalis.com, and LinkedIn processes information under its own terms and privacy information.
5. Other Disclosures of Personal Data
Where necessary and legally justified, NERQALIS may disclose personal data to:
- service providers supporting website, email or business operations;
- clients and authorised project participants;
- project subcontractors;
- legal, accounting, tax, compliance or other professional advisers;
- courts, regulatory bodies, law-enforcement bodies and other competent authorities; or
- another party where disclosure is necessary for a transaction, dispute, legal claim or compliance matter.
NERQALIS limits disclosures to information necessary for the relevant purpose and applies appropriate confidentiality, contractual or legal safeguards.
NERQALIS does not sell personal data to advertisers.
6. International Transfers
Some service providers may process personal data in, or permit access from, countries outside the European Economic Area.
Where the GDPR applies to an international transfer, NERQALIS relies on the transfer mechanism and safeguards applicable to the relevant provider, service and destination. These may include:
- an adequacy decision adopted by the European Commission;
- the EU–U.S. Data Privacy Framework, where the relevant recipient and transfer are covered;
- European Commission Standard Contractual Clauses; and
- supplementary contractual, organisational or technical measures where required.
6.1 Cloudflare Transfers
Cloudflare operates internationally, and website request and security data may be processed outside the EEA. The applicable Cloudflare service documentation states the transfer arrangements and contractual safeguards used for the relevant service. Depending on the recipient and circumstances, these arrangements may include participation in the EU–U.S. Data Privacy Framework and contractual transfer safeguards.
NERQALIS does not guarantee in this Notice that one specific mechanism applies to every Cloudflare processing operation. The applicable mechanism depends on the service, recipient, destination and contractual documentation in force.
6.2 Zoho Mail Transfers
Zoho operates internationally. Business emails, contact information and attachments may therefore be processed outside the EEA or accessed by Zoho group entities and relevant service providers in other countries.
Zoho’s applicable data-protection documentation describes the safeguards used for international transfers, including contractual arrangements based on the European Commission’s Standard Contractual Clauses where relevant.
6.3 Google Search Console Transfers
Google provides Search Console through international infrastructure. Information connected with the Search Console account may be processed outside the EEA in accordance with Google’s applicable service terms, privacy information and transfer arrangements.
Google Search Console is not embedded in the website as a visitor analytics or advertising technology. Its international processing is associated with the administration and use of the Search Console service.
6.4 Requesting Information About Safeguards
Further information about the transfer safeguards relevant to NERQALIS’s use of these providers may be requested by emailing contact@nerqalis.com.
Where available and subject to necessary protection of confidential or commercially sensitive information, NERQALIS will provide information about, or a copy of, the relevant safeguard.
7. Cookies and Similar Technologies
7.1 Current Website Configuration
NERQALIS does not currently intentionally use non-essential analytics, advertising or marketing trackers on nerqalis.com.
The current website does not use:
- Google Analytics;
- Google Tag Manager;
- Google Ads;
- Meta Pixel;
- LinkedIn Insight Tag;
- Microsoft Clarity;
- Hotjar;
- reCAPTCHA;
- YouTube or Vimeo embeds;
- chat widgets; or
- other marketing or behavioural analytics trackers.
The website’s JavaScript is used for local presentation and navigation functions. It is not currently used by NERQALIS to set non-essential analytics or marketing cookies.
7.2 Strictly Necessary Cloudflare Mechanisms
Cloudflare may set strictly necessary cookies or use similar technical mechanisms when required by enabled security, traffic-management or network functions.
These mechanisms support or protect the website service requested by the visitor. NERQALIS does not use them for advertising or behavioural profiling.
The particular mechanisms used may depend on the live Cloudflare configuration and the security or traffic conditions applying when the website is accessed. NERQALIS therefore does not list unverified cookie names or durations in this Notice.
7.3 Why No Consent Banner Is Currently Displayed
NERQALIS does not currently display a cookie consent banner because the present website configuration does not intentionally use non-essential analytics, advertising or marketing technologies requiring prior consent.
NERQALIS will reassess the live website configuration, this Notice and the applicable consent requirements before introducing any non-essential:
- analytics or measurement technology;
- advertising or marketing tracker;
- social-media plugin;
- embedded media;
- profiling technology; or
- similar storage or access mechanism.
Where consent is legally required, the relevant technology will not be activated before valid consent has been obtained, and an appropriate consent-management mechanism will be implemented.
8. Information Security
NERQALIS applies technical and organisational measures proportionate to the nature of the personal data, the processing context and the associated risks.
Project documents are ordinarily kept in controlled local storage. Access is restricted to persons who require the information for the relevant engagement or another authorised business, legal or compliance purpose.
No method of transmission, storage or security can guarantee absolute security. Individuals should therefore avoid sending unnecessary, sensitive or restricted information through the public website or ordinary email.
9. Classified, Export-Controlled and Restricted Information
9.1 Classified Information
Do not send classified information to NERQALIS through the public website or ordinary email.
NERQALIS’s current business model excludes the handling of classified information. A project involving classified information will be considered only after all legally required:
- personal and organisational security conditions;
- physical and information-security arrangements;
- clearances;
- licences and authorisations;
- contractual requirements; and
- approved technical information-exchange arrangements
are in place.
9.2 Export-Controlled and Other Restricted Information
Information does not need to be classified to be subject to export-control, sanctions, contractual, security or other handling restrictions.
This may include information concerning a relevant product or technology, its classification, the customer, end-user, destination, intended end-use or proposed method of technical information exchange.
Where such restrictions may apply, only a high-level, non-sensitive description should initially be sent. NERQALIS and the relevant party can then assess the applicable requirements and agree on a lawful and appropriate method of exchanging information.
A confidentiality agreement does not replace any licence, authorisation, clearance or security requirement that may apply.
10. Retention Principles
In addition to the activity-specific periods and criteria described above, NERQALIS applies the following general principles:
- personal data are retained only for as long as necessary for the purpose for which they were collected;
- statutory accounting, tax and other mandatory retention rules take priority where applicable;
- information relevant to an actual or reasonably anticipated claim may be retained for the applicable limitation period and until the matter is resolved;
- project records are reviewed according to their category, purpose, contractual relevance and applicable compliance requirements; and
- records are securely deleted or anonymised when they are no longer required.
The same document may be subject to more than one retention requirement. In that case, NERQALIS applies the longest relevant period that is necessary and legally justified.
11. NERQALIS as Controller or Processor
NERQALIS’s role depends on the circumstances and the nature of the relevant processing.
NERQALIS generally acts as a controller for:
- operation and security of its website;
- handling its own business enquiries;
- management of its professional contacts;
- administration of its business;
- invoicing, accounting and compliance obligations; and
- protection of its legal rights.
For some client projects, NERQALIS may process personal data on behalf of a client and under that client’s documented instructions. In those circumstances, the client is normally the controller and NERQALIS acts as a processor.
Where Article 28 GDPR applies:
- appropriate contractual data-processing terms will be in place before the processing begins;
- NERQALIS will process personal data only on the controller’s documented instructions, unless processing is required by applicable law;
- the controller remains responsible for determining the purposes and essential means of processing and for providing the relevant privacy information to data subjects; and
- data-subject requests concerning client-controlled data may need to be referred to the relevant client.
NERQALIS may still act as an independent controller for its own legal obligations, business administration and legal claims, even where it acts as a processor for other aspects of a project.
12. Is Providing Personal Data Mandatory?
There is no legal requirement to contact NERQALIS or provide personal data merely to browse the public website.
However, certain information may be necessary for NERQALIS to:
- respond meaningfully to an enquiry;
- identify and communicate with the relevant contact;
- assess the proposed scope and lawfulness of an engagement;
- prepare or perform a contract;
- administer a project;
- issue and retain invoices;
- meet accounting, tax, sanctions, export-control, security or other compliance requirements; or
- protect legal rights and manage claims.
Where required information is not provided, NERQALIS may be unable to respond fully, assess or accept the proposed engagement, enter into or perform a contract, continue an existing engagement or meet the applicable request.
13. Your Data-Protection Rights
Subject to the conditions and limitations of the GDPR, you may exercise the following rights.
13.1 Access
You may request confirmation of whether NERQALIS processes your personal data and, where it does, request access to the data and related information.
13.2 Rectification
You may ask NERQALIS to correct inaccurate personal data and complete incomplete data.
13.3 Erasure
You may request deletion of your personal data where one of the grounds under the GDPR applies. This right does not apply where continued processing is necessary, for example, to comply with a legal obligation or establish, exercise or defend legal claims.
13.4 Restriction
You may request that processing be restricted in circumstances specified by the GDPR.
13.5 Data Portability
Where processing is based on consent or contract and is carried out by automated means, you may have the right to receive personal data you provided in a structured, commonly used and machine-readable format and, where technically feasible, have those data transmitted to another controller.
13.6 Objection
Where processing is based on NERQALIS’s legitimate interests, you may object on grounds relating to your particular situation. NERQALIS will then stop the relevant processing unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing, you may object at any time. The data will then no longer be processed for that purpose.
13.7 Withdrawal of Consent
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
The processing described in this Notice does not currently rely generally on consent. This right applies if and to the extent that NERQALIS introduces or carries out consent-based processing.
13.8 Exercising Your Rights
Requests may be sent to contact@nerqalis.com.
NERQALIS may request additional information where reasonably necessary to confirm the requester’s identity and protect personal data against unauthorised disclosure. NERQALIS responds to requests without undue delay and, in principle, within one month of receipt, subject to any extension permitted by the GDPR.
14. Complaints
You have the right to lodge a complaint with the Hungarian supervisory authority:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
Email: ugyfelszolgalat@naih.hu
Website: www.naih.hu
Where applicable, you may instead complain to another competent EEA supervisory authority, particularly in the country of your habitual residence, place of work or the place of the alleged infringement.
NERQALIS encourages individuals to contact contact@nerqalis.com first where they would like an issue to be reviewed directly, but this is not a condition for lodging a complaint with a supervisory authority.
15. Automated Decision-Making
NERQALIS does not use the website or the processing described in this Notice for solely automated decision-making that produces legal effects concerning an individual or similarly significantly affects an individual.
16. Changes to This Notice
NERQALIS may update this Notice where its website, services, processing activities, service providers, technical configuration or legal obligations change.
The current version will be published on nerqalis.com and will state the date of the latest update.